# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Sep 16 2019 10:43:25 # Log Creation Date: 13.10.2019 12:55:11.123 Process: id = "1" image_name = "rsdf54refsd.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rsdf54refsd.exe" page_root = "0x514b7000" os_pid = "0x90c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x910 [0026.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ef904 | out: lpSystemTimeAsFileTime=0x3ef904*(dwLowDateTime=0x80d27be0, dwHighDateTime=0x1d581c5)) [0026.367] GetCurrentThreadId () returned 0x910 [0026.367] GetCurrentProcessId () returned 0x90c [0026.367] QueryPerformanceCounter (in: lpPerformanceCount=0x3ef8fc | out: lpPerformanceCount=0x3ef8fc*=14653579766) returned 1 [0026.385] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0026.385] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.385] GetLastError () returned 0x57 [0026.385] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74650000 [0026.389] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0026.389] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.389] GetLastError () returned 0x57 [0026.389] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0026.390] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.390] GetLastError () returned 0x57 [0026.390] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0026.390] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0026.390] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0026.390] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.390] GetLastError () returned 0x57 [0026.390] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74650000 [0026.390] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0026.390] GetProcessHeap () returned 0x7d0000 [0026.391] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.391] GetLastError () returned 0x57 [0026.391] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0026.391] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.391] GetLastError () returned 0x57 [0026.391] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0026.391] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0026.391] GetLastError () returned 0x57 [0026.391] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0026.391] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x364) returned 0x7e7358 [0026.391] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0026.391] SetLastError (dwErrCode=0x57) [0026.391] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0xc00) returned 0x7e76c8 [0026.393] GetStartupInfoW (in: lpStartupInfo=0x3ef82c | out: lpStartupInfo=0x3ef82c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1070d90, hStdOutput=0xe9589b58, hStdError=0xfffffffe)) [0026.393] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0026.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.393] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0026.393] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" " [0026.393] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" " [0026.393] GetLastError () returned 0x57 [0026.393] SetLastError (dwErrCode=0x57) [0026.393] GetLastError () returned 0x57 [0026.393] SetLastError (dwErrCode=0x57) [0026.393] GetACP () returned 0x4e4 [0026.393] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x0, Size=0x220) returned 0x7e7010 [0026.393] IsValidCodePage (CodePage=0x4e4) returned 1 [0026.393] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3ef85c | out: lpCPInfo=0x3ef85c) returned 1 [0026.393] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3ef124 | out: lpCPInfo=0x3ef124) returned 1 [0026.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef738, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0026.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef738, cbMultiByte=256, lpWideCharStr=0x3eeec8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0026.393] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x3ef138 | out: lpCharType=0x3ef138) returned 1 [0026.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef738, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0026.393] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef738, cbMultiByte=256, lpWideCharStr=0x3eee78, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0026.393] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0026.393] GetLastError () returned 0x57 [0026.393] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0026.394] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0026.394] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0026.394] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x3eec68, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0026.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x3ef638, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿü\x1alètø>", lpUsedDefaultChar=0x0) returned 256 [0026.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef738, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0026.394] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3ef738, cbMultiByte=256, lpWideCharStr=0x3eee88, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0026.394] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0026.394] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x3eec78, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0026.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x3ef538, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿü\x1alètø>", lpUsedDefaultChar=0x0) returned 256 [0026.394] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x0, Size=0x80) returned 0x7e7238 [0026.394] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10aa6e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rsdf54refsd.exe")) returned 0x35 [0026.394] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x74) returned 0x7df7f0 [0026.395] RtlInitializeSListHead (in: ListHead=0x10a9b70 | out: ListHead=0x10a9b70) [0026.395] GetLastError () returned 0x0 [0026.395] SetLastError (dwErrCode=0x0) [0026.395] GetEnvironmentStringsW () returned 0x7e8ad0* [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x0, Size=0xaca) returned 0x7e95a8 [0026.395] FreeEnvironmentStringsW (penv=0x7e8ad0) returned 1 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x98) returned 0x7e8ad0 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x3e) returned 0x7e42a8 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x6c) returned 0x7e8b70 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x6e) returned 0x7e8be8 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x78) returned 0x7df870 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x62) returned 0x7e8c60 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x2e) returned 0x7df308 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x48) returned 0x7e8cd0 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x28) returned 0x7e8d20 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x1a) returned 0x7e87c0 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x4a) returned 0x7e8d50 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x72) returned 0x7df8f0 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x30) returned 0x7e8da8 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x2e) returned 0x7e8de0 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x1c) returned 0x7e87e8 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0xd2) returned 0x7e8e18 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x7c) returned 0x7e8ef8 [0026.395] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x36) returned 0x7e8f80 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x3a) returned 0x7e42f0 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x90) returned 0x7e8fc0 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x24) returned 0x7e9058 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x30) returned 0x7e9088 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x36) returned 0x7e90c0 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x48) returned 0x7e9100 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x52) returned 0x7e9150 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x3c) returned 0x7e4338 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x82) returned 0x7e91b0 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x2e) returned 0x7e9240 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x1e) returned 0x7e8810 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x2c) returned 0x7e9278 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x54) returned 0x7e92b0 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x52) returned 0x7e9310 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x2a) returned 0x7e9370 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x3c) returned 0x7e4380 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x54) returned 0x7e93a8 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x24) returned 0x7e9408 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x30) returned 0x7e9438 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x8c) returned 0x7e9470 [0026.396] HeapFree (in: hHeap=0x7d0000, dwFlags=0x0, lpMem=0x7e95a8 | out: hHeap=0x7d0000) returned 1 [0026.396] RtlAllocateHeap (HeapHandle=0x7d0000, Flags=0x8, Size=0x800) returned 0x7e9508 [0026.396] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0026.396] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x107074d) returned 0x0 [0026.396] GetStartupInfoW (in: lpStartupInfo=0x3ef894 | out: lpStartupInfo=0x3ef894*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0072.811] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ef468, nSize=0x103 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rsdf54refsd.exe")) returned 0x35 [0072.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rsdf54refsd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98 [0072.812] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e45d [0072.813] VirtualAlloc (lpAddress=0x0, dwSize=0x5e45d, flAllocationType=0x3000, flProtect=0x4) returned 0xe0000 [0072.813] ReadFile (in: hFile=0x98, lpBuffer=0xe0000, nNumberOfBytesToRead=0x5e45d, lpNumberOfBytesRead=0x3ef878, lpOverlapped=0x0 | out: lpBuffer=0xe0000*, lpNumberOfBytesRead=0x3ef878*=0x5e45d, lpOverlapped=0x0) returned 1 [0072.821] VirtualAlloc (lpAddress=0x0, dwSize=0x11e5d, flAllocationType=0x3000, flProtect=0x4) returned 0x190000 [0072.822] VirtualAlloc (lpAddress=0x0, dwSize=0x4e05, flAllocationType=0x3000, flProtect=0x4) returned 0x140000 [0072.823] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.823] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.823] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x9c [0072.825] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x9c [0072.828] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.828] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.828] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.828] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.829] Process32First (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.830] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.830] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.830] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.830] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.830] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.831] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.831] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.831] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.831] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.831] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.832] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.832] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.832] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.832] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.833] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.833] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.833] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.833] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.834] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.834] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.834] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.834] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.834] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.835] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.835] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.835] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.835] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.835] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.836] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.836] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.836] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.836] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.836] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.837] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.837] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.837] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.837] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.837] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.838] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.838] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.838] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.838] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.838] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.839] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.839] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.839] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.839] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.839] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.840] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.840] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.840] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.840] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.840] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.841] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.841] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.841] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.841] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.842] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.842] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.842] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.842] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.842] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.843] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.843] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.843] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.843] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.843] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.844] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.844] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.844] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.844] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.844] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.845] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.845] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.845] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.845] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.845] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.846] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.846] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.846] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.846] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.847] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.847] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.847] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.847] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.847] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.848] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.848] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.848] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.848] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.848] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.849] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.849] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.849] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.849] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.849] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.850] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.850] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.850] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.850] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.850] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.851] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.851] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.851] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.851] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.851] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.852] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.852] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.852] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.852] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.853] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.853] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.853] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.853] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.853] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.854] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.854] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.854] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.854] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.854] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.855] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.855] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.855] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.855] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.855] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0072.856] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.856] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.856] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.856] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.856] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0072.857] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.857] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.857] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.857] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.857] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0072.858] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.858] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.858] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.858] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.859] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0072.859] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.859] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.859] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.859] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.860] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0072.860] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.860] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.860] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.860] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.861] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0072.861] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.861] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.861] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.862] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.862] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0072.862] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.862] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.862] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.863] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.863] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0072.863] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.863] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.863] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.864] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.864] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0072.864] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.864] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.864] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.865] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.865] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0072.865] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.865] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.865] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.866] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.866] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0072.866] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.866] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.866] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.867] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.867] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0072.867] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.867] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.867] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.868] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.868] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0072.869] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.869] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.869] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.869] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.869] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0072.870] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.870] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.870] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.870] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.870] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0072.871] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.871] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.871] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.871] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.871] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0072.872] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.872] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.872] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.872] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.872] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0072.873] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.873] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.873] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.873] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.873] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.874] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.874] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.874] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.874] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.874] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rsdf54refsd.exe")) returned 1 [0072.875] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.875] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.875] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.875] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.875] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.876] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.876] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.876] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.876] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0072.876] Process32Next (in: hSnapshot=0x9c, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x0, th32ParentProcessID=0x3ee628, pcPriClassBase=8204896, dwFlags=0x7d329c, szExeFile="???>???>?}?>?>?>")) returned 0 [0072.877] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.877] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.877] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.878] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0xa0 [0072.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xa0 [0072.879] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.880] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.880] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.880] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.881] Process32First (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.881] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.881] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.881] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.882] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.882] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.882] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.883] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.883] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.883] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.883] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.893] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.893] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.893] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.893] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.893] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.894] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.894] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.894] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.894] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.894] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.895] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.895] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.895] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.895] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.895] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.896] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.896] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.896] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.896] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.896] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.897] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.897] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.897] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.897] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.897] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.898] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.898] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.898] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.898] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.898] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.899] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.899] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.899] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.899] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.899] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.900] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.900] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.900] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.900] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.900] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.901] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.901] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.901] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.901] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.901] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.902] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.902] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.902] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.902] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.902] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.903] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.903] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.903] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.903] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.904] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.904] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.904] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.904] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.904] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.905] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.905] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.905] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.905] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.906] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.906] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.906] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.906] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.906] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.907] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.907] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.907] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.907] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.907] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.908] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.908] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.908] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.908] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.908] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.909] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.909] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.909] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.909] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.909] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.910] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.910] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.910] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.910] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.910] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.911] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.911] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.911] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.911] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.911] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.912] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.912] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.912] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.912] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.912] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.913] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.913] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.913] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.913] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.913] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.914] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.914] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.914] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.914] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.914] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.915] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.915] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.915] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.915] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.916] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.916] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.916] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0072.916] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.916] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.917] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.917] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.917] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0072.917] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.917] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.918] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.918] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.918] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0072.918] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.919] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.919] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.919] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.919] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0072.919] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.920] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.920] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.920] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.920] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0072.920] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.921] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.921] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.921] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.921] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0072.921] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.922] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.922] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.922] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.922] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0072.922] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.923] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.923] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.923] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.923] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0072.923] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.924] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.924] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.924] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.924] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0072.924] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.925] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.925] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.925] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.925] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0072.926] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.926] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.926] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.926] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.926] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0072.927] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.927] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.927] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.927] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.927] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0072.928] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.928] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.928] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.928] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.928] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0072.929] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.929] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.929] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.929] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.929] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0072.930] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.930] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.930] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.930] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.930] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0072.931] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.931] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.931] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.931] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.931] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0072.932] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.932] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.932] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.932] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.932] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0072.933] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.933] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.933] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.933] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.933] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.934] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.934] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.934] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.934] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.934] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rsdf54refsd.exe")) returned 1 [0072.935] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.935] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.935] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.935] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.935] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.936] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.936] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.936] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x1b0000 [0072.936] CallWindowProcW (lpPrevWndFunc=0x1b0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0072.936] Process32Next (in: hSnapshot=0xa0, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x0, th32ParentProcessID=0x3ee628, pcPriClassBase=8204896, dwFlags=0x7d329c, szExeFile="???>???>?}?>?>?>")) returned 0 [0072.937] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2, flAllocationType=0x3000, flProtect=0x4) returned 0x1b0000 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x3000, flProtect=0x4) returned 0x1c0000 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x1d0000 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x1e0000 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x1f0000 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x3000, flProtect=0x4) returned 0x200000 [0072.939] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x210000 [0072.940] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x3000, flProtect=0x4) returned 0x220000 [0072.941] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2f, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0072.941] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x15 [0072.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1c0000, cbMultiByte=-1, lpWideCharStr=0x3ef088, cchWideChar=50 | out: lpWideCharStr="mgqdgtqwehawqcrnvuea") returned 21 [0072.942] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.942] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2f, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0072.943] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x5 [0072.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1d0000, cbMultiByte=-1, lpWideCharStr=0x3ef0ec, cchWideChar=50 | out: lpWideCharStr="ulop") returned 5 [0072.943] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.943] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.943] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0072.944] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0xa4 [0072.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xa4 [0072.994] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.994] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.994] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0072.995] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0072.995] Process32First (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.996] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.996] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0072.996] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0072.997] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.000] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.001] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.001] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.001] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.001] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.001] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.002] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.002] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.002] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.002] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.002] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.003] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.003] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.003] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.003] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.003] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.004] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.004] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.004] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.005] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.005] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.005] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.005] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.005] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.006] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.006] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.006] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.006] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.006] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.007] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.007] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.007] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.007] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.007] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.008] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.008] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.008] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.008] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.009] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.009] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.009] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.009] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.010] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.010] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.010] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.010] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.010] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.011] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.011] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.011] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.011] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.012] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.012] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.012] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.012] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.012] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.013] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.013] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.013] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.013] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.013] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.014] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.014] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.014] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.014] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.014] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.015] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.015] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.015] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.015] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.015] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.016] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.016] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.016] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.016] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.016] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.017] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.017] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.017] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.017] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.017] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.018] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.018] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.018] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.019] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.019] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.019] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.019] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.019] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.020] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.020] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.020] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.020] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.020] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.021] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.021] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.021] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.021] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.021] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.022] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.022] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.022] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.022] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.023] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.023] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.023] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.023] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.023] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.024] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.024] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.024] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.024] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.025] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.025] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.025] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.025] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.026] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.026] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.026] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.026] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.026] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0073.027] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.027] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.027] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.027] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.027] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0073.028] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.028] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.028] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.028] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.028] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0073.029] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.029] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.029] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.029] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.029] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0073.030] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.030] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.030] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.031] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.031] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0073.031] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.031] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.032] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.032] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.032] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0073.032] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.032] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.033] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.033] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.033] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0073.033] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.034] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.034] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.034] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.034] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0073.034] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.035] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.035] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.035] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.035] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0073.036] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.036] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.036] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.036] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.036] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0073.037] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.037] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.037] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.037] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.037] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0073.038] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.038] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.038] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.038] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.038] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0073.039] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.039] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.039] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.039] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.039] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0073.040] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.040] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.040] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.041] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.041] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0073.041] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.041] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.041] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.042] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.042] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0073.042] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.042] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.042] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.043] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.043] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0073.043] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.043] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.044] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.044] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.044] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0073.044] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.044] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.045] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.045] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.045] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.045] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.045] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.046] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.046] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.046] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rsdf54refsd.exe")) returned 1 [0073.047] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.047] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.047] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.048] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.048] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.048] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.048] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.048] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.049] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0073.049] Process32Next (in: hSnapshot=0xa4, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x0, th32ParentProcessID=0x3ee628, pcPriClassBase=8204896, dwFlags=0x7d329c, szExeFile="???>???>?}?>?>?>")) returned 0 [0073.049] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.049] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.049] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.050] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0xa8 [0073.050] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xa8 [0073.052] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.052] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.052] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.052] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.053] Process32First (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.053] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.053] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.054] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.054] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.054] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.055] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.055] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.055] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.055] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.055] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.056] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.056] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.056] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.056] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.056] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.057] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.057] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.057] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.057] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.058] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.058] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.058] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.058] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.059] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.059] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.059] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.059] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.059] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.060] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.060] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.060] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.060] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.060] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.061] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.061] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.061] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.061] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.061] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.062] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.062] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.062] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.062] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.062] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.063] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.063] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.063] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.063] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.063] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.064] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.064] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.064] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.064] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.065] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.065] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.065] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.065] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.066] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.066] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.066] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.066] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.067] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.067] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.067] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.067] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.067] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.068] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.068] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.068] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.068] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.068] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.069] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.069] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.069] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.069] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.070] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.070] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.070] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.070] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.071] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.071] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.071] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.071] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.071] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.072] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.072] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.072] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.072] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.072] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.073] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.073] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.073] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.073] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.073] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.074] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.074] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.074] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.074] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.074] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.075] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.075] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.075] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.075] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.075] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.076] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.076] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.076] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.076] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.077] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.077] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.077] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.077] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.077] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.078] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.078] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.078] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.078] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.078] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.079] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.079] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.079] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.079] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.079] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.080] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.080] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.080] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0073.080] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.081] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.081] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.081] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.081] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0073.081] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.082] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.082] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.082] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.082] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0073.083] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.083] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.083] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.083] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.083] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0073.084] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.084] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.084] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.084] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.084] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0073.085] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.085] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.085] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.085] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.085] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0073.086] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.086] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.086] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.086] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.086] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0073.087] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.087] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.087] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.087] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.087] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0073.088] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.088] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.088] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.088] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.088] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0073.089] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.089] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.089] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.089] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.089] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0073.090] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.090] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.090] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.090] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.091] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0073.091] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.091] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.091] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.092] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.092] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0073.092] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.092] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.092] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.093] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.093] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0073.093] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.093] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.093] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.094] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.094] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0073.094] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.094] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.094] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.095] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.095] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0073.095] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.097] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.097] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.097] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.097] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0073.098] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.098] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.098] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.098] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.099] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0073.099] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.099] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.099] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.100] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.100] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.100] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.100] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.100] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.101] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.101] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rsdf54refsd.exe")) returned 1 [0073.101] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.101] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.101] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.102] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x1 [0073.103] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.104] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.104] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.104] VirtualAlloc (lpAddress=0x0, dwSize=0x1b, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.104] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0073.104] Process32Next (in: hSnapshot=0xa8, lppe=0x3ee9d4 | out: lppe=0x3ee9d4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x0, th32ParentProcessID=0x3ee628, pcPriClassBase=8204896, dwFlags=0x7d329c, szExeFile="???>???>?}?>?>?>")) returned 0 [0073.105] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.105] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.105] VirtualAlloc (lpAddress=0x0, dwSize=0x16, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.105] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0073.106] Sleep (dwMilliseconds=0x0) [0073.108] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.108] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3eec34, nSize=0x103 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rsdf54refsd.exe")) returned 0x35 [0073.108] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.109] VirtualAlloc (lpAddress=0x0, dwSize=0x25, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.109] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x240000 [0073.109] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x240000 [0073.110] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.110] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" " [0073.110] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\svchost.exe", lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x3eeb14*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3eebac | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" ", lpProcessInformation=0x3eebac*(hProcess=0xb0, hThread=0xac, dwProcessId=0xa28, dwThreadId=0xa2c)) returned 1 [0073.126] GetThreadContext (in: hThread=0xac, lpContext=0x3ee848 | out: lpContext=0x3ee848*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x3ee878, FloatSave.ControlWord=0x7d3260, FloatSave.StatusWord=0x7d329c, FloatSave.TagWord=0x77234890, FloatSave.ErrorOffset=0x3ee890, FloatSave.ErrorSelector=0x7715f9f9, FloatSave.DataOffset=0x3eeba0, FloatSave.DataSelector=0x7d328c, FloatSave.RegisterArea=([0]=0xb4, [1]=0x46, [2]=0x3e, [3]=0x0, [4]=0xc4, [5]=0xe9, [6]=0x3e, [7]=0x0, [8]=0x24, [9]=0xeb, [10]=0x3e, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x78, [17]=0xe9, [18]=0x3e, [19]=0x0, [20]=0x1, [21]=0xc5, [22]=0x16, [23]=0x77, [24]=0xc4, [25]=0xe9, [26]=0x3e, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0xd6, [33]=0xc1, [34]=0x16, [35]=0x77, [36]=0x2d, [37]=0xbe, [38]=0x1c, [39]=0x77, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x8c, [45]=0xeb, [46]=0x3e, [47]=0x0, [48]=0x1, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x3d, [53]=0x96, [54]=0x37, [55]=0x0, [56]=0x4, [57]=0xf9, [58]=0x3e, [59]=0x0, [60]=0x1e, [61]=0xa6, [62]=0xfb, [63]=0x74, [64]=0x35, [65]=0xaa, [66]=0x13, [67]=0x95, [68]=0xfe, [69]=0xff, [70]=0xff, [71]=0xff, [72]=0x51, [73]=0x6d, [74]=0xf5, [75]=0x74, [76]=0x27, [77]=0xd, [78]=0xf6, [79]=0x74), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xdd2104, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x1bfcf4, SegSs=0x2b, ExtendedRegisters=([0]=0x5c, [1]=0xeb, [2]=0x3e, [3]=0x0, [4]=0x44, [5]=0xe9, [6]=0x3e, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x8c, [13]=0xeb, [14]=0x3e, [15]=0x0, [16]=0x28, [17]=0xfb, [18]=0x15, [19]=0x77, [20]=0x3, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0xc0, [25]=0xe9, [26]=0x3e, [27]=0x0, [28]=0x61, [29]=0xbe, [30]=0x1c, [31]=0x77, [32]=0x74, [33]=0xe9, [34]=0x3e, [35]=0x0, [36]=0xd6, [37]=0xfa, [38]=0x15, [39]=0x77, [40]=0x1, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x5c, [45]=0xeb, [46]=0x3e, [47]=0x0, [48]=0x64, [49]=0xfa, [50]=0x15, [51]=0x77, [52]=0xc4, [53]=0xe9, [54]=0x3e, [55]=0x0, [56]=0xb8, [57]=0xe9, [58]=0x3e, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0xa4, [77]=0xe8, [78]=0x3e, [79]=0x0, [80]=0x5c, [81]=0xeb, [82]=0x3e, [83]=0x0, [84]=0xe8, [85]=0xea, [86]=0x3e, [87]=0x0, [88]=0xcd, [89]=0x1e, [90]=0x1a, [91]=0x77, [92]=0xd, [93]=0xea, [94]=0x37, [95]=0x0, [96]=0xfe, [97]=0xff, [98]=0xff, [99]=0xff, [100]=0xd6, [101]=0xc1, [102]=0x16, [103]=0x77, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x1, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x8c, [113]=0xeb, [114]=0x3e, [115]=0x0, [116]=0xf8, [117]=0xea, [118]=0x3e, [119]=0x0, [120]=0x34, [121]=0xc4, [122]=0x16, [123]=0x77, [124]=0x92, [125]=0xe1, [126]=0x15, [127]=0x77, [128]=0x19, [129]=0xc4, [130]=0x16, [131]=0x77, [132]=0xad, [133]=0xbd, [134]=0x1c, [135]=0x77, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0xda, [145]=0x29, [146]=0x15, [147]=0x77, [148]=0x40, [149]=0xeb, [150]=0x3e, [151]=0x0, [152]=0x70, [153]=0xeb, [154]=0x3e, [155]=0x0, [156]=0xff, [157]=0xff, [158]=0xe, [159]=0x0, [160]=0x0, [161]=0xe9, [162]=0x3e, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x24, [173]=0xeb, [174]=0x3e, [175]=0x0, [176]=0x14, [177]=0x0, [178]=0x16, [179]=0x0, [180]=0x8c, [181]=0xeb, [182]=0x3e, [183]=0x0, [184]=0xa8, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0xc4, [189]=0xe9, [190]=0x3e, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x60, [197]=0x32, [198]=0x7d, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x81, [213]=0xfd, [214]=0x14, [215]=0x77, [216]=0x50, [217]=0x2c, [218]=0x97, [219]=0x75, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x7c, [225]=0x2c, [226]=0x97, [227]=0x75, [228]=0x8b, [229]=0xa8, [230]=0x34, [231]=0xdf, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x4, [237]=0x0, [238]=0x23, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x24, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x1, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0xc2, [285]=0xfa, [286]=0x14, [287]=0x77, [288]=0xc, [289]=0xe3, [290]=0x96, [291]=0x75, [292]=0xff, [293]=0xff, [294]=0xff, [295]=0xff, [296]=0x64, [297]=0xea, [298]=0x3e, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x50, [305]=0xea, [306]=0x3e, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x4, [317]=0x0, [318]=0x23, [319]=0x0, [320]=0x70, [321]=0xea, [322]=0x3e, [323]=0x0, [324]=0x7d, [325]=0xe3, [326]=0x96, [327]=0x75, [328]=0xff, [329]=0xff, [330]=0xff, [331]=0xff, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x24, [339]=0x0, [340]=0x0, [341]=0x30, [342]=0x0, [343]=0x0, [344]=0x4, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0xa0, [349]=0xea, [350]=0x3e, [351]=0x0, [352]=0x24, [353]=0x0, [354]=0x23, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x40, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x30, [366]=0x0, [367]=0x0, [368]=0x4, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0xfa, [373]=0x62, [374]=0xf5, [375]=0x74, [376]=0x4, [377]=0x0, [378]=0x23, [379]=0x0, [380]=0xcd, [381]=0xab, [382]=0xba, [383]=0xdc, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x4, [393]=0x0, [394]=0x23, [395]=0x0, [396]=0x18, [397]=0xeb, [398]=0x3e, [399]=0x0, [400]=0xcc, [401]=0xea, [402]=0x3e, [403]=0x0, [404]=0x4, [405]=0x0, [406]=0x23, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x18, [413]=0xeb, [414]=0x3e, [415]=0x0, [416]=0x91, [417]=0x6d, [418]=0xf5, [419]=0x74, [420]=0x51, [421]=0x6d, [422]=0xf5, [423]=0x74, [424]=0x75, [425]=0x2c, [426]=0xd8, [427]=0xe1, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x4, [433]=0x0, [434]=0x23, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x19, [439]=0x0, [440]=0x24, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x1, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x70, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0xff, [461]=0xff, [462]=0xff, [463]=0xff, [464]=0xff, [465]=0xff, [466]=0xff, [467]=0xff, [468]=0xe9, [469]=0x6c, [470]=0xf5, [471]=0x74, [472]=0x91, [473]=0x6d, [474]=0xf5, [475]=0x74, [476]=0xa5, [477]=0xeb, [478]=0x37, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x24, [491]=0x0, [492]=0xbc, [493]=0xea, [494]=0x3e, [495]=0x0, [496]=0x3d, [497]=0x96, [498]=0x37, [499]=0x0, [500]=0x4, [501]=0xf9, [502]=0x3e, [503]=0x0, [504]=0x1e, [505]=0xa6, [506]=0xfb, [507]=0x74, [508]=0x35, [509]=0xaa, [510]=0x13, [511]=0x95))) returned 1 [0073.203] ReadProcessMemory (in: hProcess=0xb0, lpBaseAddress=0x7efde008, lpBuffer=0x3eeba8, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x3eeba8*, lpNumberOfBytesRead=0x0) returned 1 [0073.207] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ee730 | out: Wow64Process=0x3ee730) returned 1 [0073.209] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0073.209] GetFileSize (in: hFile=0xb8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0073.209] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x960000 [0073.209] ReadFile (in: hFile=0xb8, lpBuffer=0x960000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x3ee728, lpOverlapped=0x0 | out: lpBuffer=0x960000*, lpNumberOfBytesRead=0x3ee728*=0x13b740, lpOverlapped=0x0) returned 1 [0073.252] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0xbf0000 [0073.269] CloseHandle (hObject=0xb8) returned 1 [0073.269] VirtualFree (lpAddress=0x960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.275] VirtualFree (lpAddress=0xbf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.281] NtCreateSection (in: SectionHandle=0x3ee80c, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x3eeb5c, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x3ee80c*=0xb8) returned 0x0 [0073.285] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ee704 | out: Wow64Process=0x3ee704) returned 1 [0073.286] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0073.287] GetFileSize (in: hFile=0xb4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0073.287] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x960000 [0073.287] ReadFile (in: hFile=0xb4, lpBuffer=0x960000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x3ee6fc, lpOverlapped=0x0 | out: lpBuffer=0x960000*, lpNumberOfBytesRead=0x3ee6fc*=0x13b740, lpOverlapped=0x0) returned 1 [0073.310] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0xbf0000 [0073.328] CloseHandle (hObject=0xb4) returned 1 [0073.328] VirtualFree (lpAddress=0x960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.334] VirtualFree (lpAddress=0xbf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.340] NtMapViewOfSection (in: SectionHandle=0xb8, ProcessHandle=0xb0, BaseAddress=0x3ee800*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x3ee7f8*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x3ee800*=0x400000, SectionOffset=0x0, ViewSize=0x3ee7f8*=0x12000) returned 0x0 [0073.343] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ee704 | out: Wow64Process=0x3ee704) returned 1 [0073.345] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0073.345] GetFileSize (in: hFile=0xb4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0073.345] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x960000 [0073.346] ReadFile (in: hFile=0xb4, lpBuffer=0x960000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x3ee6fc, lpOverlapped=0x0 | out: lpBuffer=0x960000*, lpNumberOfBytesRead=0x3ee6fc*=0x13b740, lpOverlapped=0x0) returned 1 [0073.361] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0xbf0000 [0073.378] CloseHandle (hObject=0xb4) returned 1 [0073.378] VirtualFree (lpAddress=0x960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.384] VirtualFree (lpAddress=0xbf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.390] NtMapViewOfSection (in: SectionHandle=0xb8, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3ee800*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x3ee7f8*=0x12000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x3ee800*=0x250000, SectionOffset=0x0, ViewSize=0x3ee7f8*=0x12000) returned 0x0 [0073.394] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ee744 | out: Wow64Process=0x3ee744) returned 1 [0073.396] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0073.396] GetFileSize (in: hFile=0xb4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0073.396] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x960000 [0073.397] ReadFile (in: hFile=0xb4, lpBuffer=0x960000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x3ee73c, lpOverlapped=0x0 | out: lpBuffer=0x960000*, lpNumberOfBytesRead=0x3ee73c*=0x13b740, lpOverlapped=0x0) returned 1 [0073.412] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0xbf0000 [0073.429] CloseHandle (hObject=0xb4) returned 1 [0073.429] VirtualFree (lpAddress=0x960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.436] VirtualFree (lpAddress=0xbf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.441] NtWriteVirtualMemory (in: ProcessHandle=0xb0, BaseAddress=0x7efde008, Buffer=0x3eebc0*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x3ee810 | out: Buffer=0x3eebc0*, NumberOfBytesWritten=0x3ee810*=0x4) returned 0x0 [0073.441] SetThreadContext (hThread=0xac, lpContext=0x3ee848*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x3ee878, FloatSave.ControlWord=0x7d3260, FloatSave.StatusWord=0x7d329c, FloatSave.TagWord=0x77234890, FloatSave.ErrorOffset=0x3ee890, FloatSave.ErrorSelector=0x7715f9f9, FloatSave.DataOffset=0x3eeba0, FloatSave.DataSelector=0x7d328c, FloatSave.RegisterArea=([0]=0xb4, [1]=0x46, [2]=0x3e, [3]=0x0, [4]=0xc4, [5]=0xe9, [6]=0x3e, [7]=0x0, [8]=0x24, [9]=0xeb, [10]=0x3e, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x78, [17]=0xe9, [18]=0x3e, [19]=0x0, [20]=0x1, [21]=0xc5, [22]=0x16, [23]=0x77, [24]=0xc4, [25]=0xe9, [26]=0x3e, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0xd6, [33]=0xc1, [34]=0x16, [35]=0x77, [36]=0x2d, [37]=0xbe, [38]=0x1c, [39]=0x77, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x8c, [45]=0xeb, [46]=0x3e, [47]=0x0, [48]=0x1, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x3d, [53]=0x96, [54]=0x37, [55]=0x0, [56]=0x4, [57]=0xf9, [58]=0x3e, [59]=0x0, [60]=0x1e, [61]=0xa6, [62]=0xfb, [63]=0x74, [64]=0x35, [65]=0xaa, [66]=0x13, [67]=0x95, [68]=0xfe, [69]=0xff, [70]=0xff, [71]=0xff, [72]=0x51, [73]=0x6d, [74]=0xf5, [75]=0x74, [76]=0x27, [77]=0xd, [78]=0xf6, [79]=0x74), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x402518, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x1bfcf4, SegSs=0x2b, ExtendedRegisters=([0]=0x5c, [1]=0xeb, [2]=0x3e, [3]=0x0, [4]=0x44, [5]=0xe9, [6]=0x3e, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x8c, [13]=0xeb, [14]=0x3e, [15]=0x0, [16]=0x28, [17]=0xfb, [18]=0x15, [19]=0x77, [20]=0x3, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0xc0, [25]=0xe9, [26]=0x3e, [27]=0x0, [28]=0x61, [29]=0xbe, [30]=0x1c, [31]=0x77, [32]=0x74, [33]=0xe9, [34]=0x3e, [35]=0x0, [36]=0xd6, [37]=0xfa, [38]=0x15, [39]=0x77, [40]=0x1, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x5c, [45]=0xeb, [46]=0x3e, [47]=0x0, [48]=0x64, [49]=0xfa, [50]=0x15, [51]=0x77, [52]=0xc4, [53]=0xe9, [54]=0x3e, [55]=0x0, [56]=0xb8, [57]=0xe9, [58]=0x3e, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0xa4, [77]=0xe8, [78]=0x3e, [79]=0x0, [80]=0x5c, [81]=0xeb, [82]=0x3e, [83]=0x0, [84]=0xe8, [85]=0xea, [86]=0x3e, [87]=0x0, [88]=0xcd, [89]=0x1e, [90]=0x1a, [91]=0x77, [92]=0xd, [93]=0xea, [94]=0x37, [95]=0x0, [96]=0xfe, [97]=0xff, [98]=0xff, [99]=0xff, [100]=0xd6, [101]=0xc1, [102]=0x16, [103]=0x77, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x1, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x8c, [113]=0xeb, [114]=0x3e, [115]=0x0, [116]=0xf8, [117]=0xea, [118]=0x3e, [119]=0x0, [120]=0x34, [121]=0xc4, [122]=0x16, [123]=0x77, [124]=0x92, [125]=0xe1, [126]=0x15, [127]=0x77, [128]=0x19, [129]=0xc4, [130]=0x16, [131]=0x77, [132]=0xad, [133]=0xbd, [134]=0x1c, [135]=0x77, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0xda, [145]=0x29, [146]=0x15, [147]=0x77, [148]=0x40, [149]=0xeb, [150]=0x3e, [151]=0x0, [152]=0x70, [153]=0xeb, [154]=0x3e, [155]=0x0, [156]=0xff, [157]=0xff, [158]=0xe, [159]=0x0, [160]=0x0, [161]=0xe9, [162]=0x3e, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x24, [173]=0xeb, [174]=0x3e, [175]=0x0, [176]=0x14, [177]=0x0, [178]=0x16, [179]=0x0, [180]=0x8c, [181]=0xeb, [182]=0x3e, [183]=0x0, [184]=0xa8, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0xc4, [189]=0xe9, [190]=0x3e, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x60, [197]=0x32, [198]=0x7d, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x81, [213]=0xfd, [214]=0x14, [215]=0x77, [216]=0x50, [217]=0x2c, [218]=0x97, [219]=0x75, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x7c, [225]=0x2c, [226]=0x97, [227]=0x75, [228]=0x8b, [229]=0xa8, [230]=0x34, [231]=0xdf, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x4, [237]=0x0, [238]=0x23, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x24, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x1, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0xc2, [285]=0xfa, [286]=0x14, [287]=0x77, [288]=0xc, [289]=0xe3, [290]=0x96, [291]=0x75, [292]=0xff, [293]=0xff, [294]=0xff, [295]=0xff, [296]=0x64, [297]=0xea, [298]=0x3e, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x50, [305]=0xea, [306]=0x3e, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x4, [317]=0x0, [318]=0x23, [319]=0x0, [320]=0x70, [321]=0xea, [322]=0x3e, [323]=0x0, [324]=0x7d, [325]=0xe3, [326]=0x96, [327]=0x75, [328]=0xff, [329]=0xff, [330]=0xff, [331]=0xff, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x24, [339]=0x0, [340]=0x0, [341]=0x30, [342]=0x0, [343]=0x0, [344]=0x4, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0xa0, [349]=0xea, [350]=0x3e, [351]=0x0, [352]=0x24, [353]=0x0, [354]=0x23, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x40, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x30, [366]=0x0, [367]=0x0, [368]=0x4, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0xfa, [373]=0x62, [374]=0xf5, [375]=0x74, [376]=0x4, [377]=0x0, [378]=0x23, [379]=0x0, [380]=0xcd, [381]=0xab, [382]=0xba, [383]=0xdc, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x4, [393]=0x0, [394]=0x23, [395]=0x0, [396]=0x18, [397]=0xeb, [398]=0x3e, [399]=0x0, [400]=0xcc, [401]=0xea, [402]=0x3e, [403]=0x0, [404]=0x4, [405]=0x0, [406]=0x23, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x18, [413]=0xeb, [414]=0x3e, [415]=0x0, [416]=0x91, [417]=0x6d, [418]=0xf5, [419]=0x74, [420]=0x51, [421]=0x6d, [422]=0xf5, [423]=0x74, [424]=0x75, [425]=0x2c, [426]=0xd8, [427]=0xe1, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x4, [433]=0x0, [434]=0x23, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x19, [439]=0x0, [440]=0x24, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x1, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x70, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0xff, [461]=0xff, [462]=0xff, [463]=0xff, [464]=0xff, [465]=0xff, [466]=0xff, [467]=0xff, [468]=0xe9, [469]=0x6c, [470]=0xf5, [471]=0x74, [472]=0x91, [473]=0x6d, [474]=0xf5, [475]=0x74, [476]=0xa5, [477]=0xeb, [478]=0x37, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x24, [491]=0x0, [492]=0xbc, [493]=0xea, [494]=0x3e, [495]=0x0, [496]=0x3d, [497]=0x96, [498]=0x37, [499]=0x0, [500]=0x4, [501]=0xf9, [502]=0x3e, [503]=0x0, [504]=0x1e, [505]=0xa6, [506]=0xfb, [507]=0x74, [508]=0x35, [509]=0xaa, [510]=0x13, [511]=0x95))) returned 1 [0073.446] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ee76c | out: Wow64Process=0x3ee76c) returned 1 [0073.448] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0073.448] GetFileSize (in: hFile=0xb4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0073.448] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x960000 [0073.448] ReadFile (in: hFile=0xb4, lpBuffer=0x960000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x3ee764, lpOverlapped=0x0 | out: lpBuffer=0x960000*, lpNumberOfBytesRead=0x3ee764*=0x13b740, lpOverlapped=0x0) returned 1 [0073.464] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0xbf0000 [0073.481] CloseHandle (hObject=0xb4) returned 1 [0073.481] VirtualFree (lpAddress=0x960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.487] VirtualFree (lpAddress=0xbf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.493] NtResumeThread (in: ThreadHandle=0xac, SuspendCount=0x3ee820 | out: SuspendCount=0x3ee820*=0x1) returned 0x0 [0073.527] LoadLibraryW (lpLibFileName="User32.dll") returned 0x74f40000 [0073.528] VirtualAlloc (lpAddress=0x0, dwSize=0x2a, flAllocationType=0x3000, flProtect=0x40) returned 0x230000 [0073.528] CallWindowProcW (lpPrevWndFunc=0x230004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0073.529] VirtualProtectEx (in: hProcess=0xb0, lpAddress=0x0, dwSize=0x12000, flNewProtect=0x1, lpflOldProtect=0x3eeb58 | out: lpflOldProtect=0x3eeb58*=0x51c) returned 0 [0073.529] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.529] CloseHandle (hObject=0xb0) returned 1 [0073.529] CloseHandle (hObject=0xac) returned 1 [0073.529] CloseHandle (hObject=0xb8) returned 1 [0073.533] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3ee774 | out: Wow64Process=0x3ee774) returned 1 [0073.535] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0073.535] GetFileSize (in: hFile=0xb8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b740 [0073.535] VirtualAlloc (lpAddress=0x0, dwSize=0x13b740, flAllocationType=0x3000, flProtect=0x4) returned 0x960000 [0073.535] ReadFile (in: hFile=0xb8, lpBuffer=0x960000, nNumberOfBytesToRead=0x13b740, lpNumberOfBytesRead=0x3ee76c, lpOverlapped=0x0 | out: lpBuffer=0x960000*, lpNumberOfBytesRead=0x3ee76c*=0x13b740, lpOverlapped=0x0) returned 1 [0073.551] VirtualAlloc (lpAddress=0x0, dwSize=0x180000, flAllocationType=0x3000, flProtect=0x4) returned 0xbf0000 [0073.568] CloseHandle (hObject=0xb8) returned 1 [0073.568] VirtualFree (lpAddress=0x960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.574] VirtualFree (lpAddress=0xbf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.580] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x250000) returned 0x0 [0073.580] ExitProcess (uExitCode=0x0) [0073.582] HeapFree (in: hHeap=0x7d0000, dwFlags=0x0, lpMem=0x7e7358 | out: hHeap=0x7d0000) returned 1 Thread: id = 2 os_tid = 0x958 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\syswow64\\svchost.exe" page_root = "0x4ead6000" os_pid = "0xa28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x90c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rsdf54refsd.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xa2c [0073.877] GetProcessHeap () returned 0x840000 [0073.877] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x30) returned 0x851658 [0073.877] GetProcessHeap () returned 0x840000 [0073.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x33c0) returned 0x856048 [0073.878] GetProcessHeap () returned 0x840000 [0073.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x204) returned 0x859410 [0073.879] GetProcessHeap () returned 0x840000 [0073.879] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x851408 [0073.879] GetTickCount () returned 0x114d8d2 [0073.879] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1bfaf8 | out: lpWSAData=0x1bfaf8) returned 0 [0073.886] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1bfad8, cchData=32 | out: lpLCData="\x03") returned 16 [0073.887] GetProcessHeap () returned 0x840000 [0073.887] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1c) returned 0x853da0 [0073.887] GetProcessHeap () returned 0x840000 [0073.887] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1c) returned 0x85d918 [0073.887] GetVersion () returned 0x1db10106 [0073.887] GetCurrentProcess () returned 0xffffffff [0073.887] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1bfa4c | out: TokenHandle=0x1bfa4c*=0xb4) returned 1 [0073.887] GetTokenInformation (in: TokenHandle=0xb4, TokenInformationClass=0x14, TokenInformation=0x1bfa44, TokenInformationLength=0x4, ReturnLength=0x1bfa48 | out: TokenInformation=0x1bfa44, ReturnLength=0x1bfa48) returned 1 [0073.887] CloseHandle (hObject=0xb4) returned 1 [0073.887] GetProcessHeap () returned 0x840000 [0073.887] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85d968 [0073.887] GetProcessHeap () returned 0x840000 [0073.887] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85d990 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85d9b8 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85e100 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0073.888] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85d990, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85d9b8 | out: hHeap=0x840000) returned 1 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85d968 | out: hHeap=0x840000) returned 1 [0073.888] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1bf9ec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1bf9ec*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85d990 | out: hHeap=0x840000) returned 1 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x8550a8 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x8550f0 [0073.888] GetProcessHeap () returned 0x840000 [0073.888] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8550f0, Size=0x72) returned 0x84f4c8 [0073.888] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0073.888] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xb4 [0073.888] WaitForSingleObject (hHandle=0xb4, dwMilliseconds=0x0) returned 0x0 [0073.888] GetProcessHeap () returned 0x840000 [0073.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8550a8 | out: hHeap=0x840000) returned 1 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f4c8 | out: hHeap=0x840000) returned 1 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85d990 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85d968 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85d9b8 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85e100 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0073.889] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85d968, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85d9b8 | out: hHeap=0x840000) returned 1 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85d990 | out: hHeap=0x840000) returned 1 [0073.889] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1bf9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1bf9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85d968 | out: hHeap=0x840000) returned 1 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x8550a8 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x8550f0 [0073.889] GetProcessHeap () returned 0x840000 [0073.889] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8550f0, Size=0x72) returned 0x84f4c8 [0073.889] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0073.889] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xb8 [0073.889] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0x0) returned 0x0 [0073.889] GetProcessHeap () returned 0x840000 [0073.890] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8550a8 | out: hHeap=0x840000) returned 1 [0073.890] GetProcessHeap () returned 0x840000 [0073.890] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f4c8 | out: hHeap=0x840000) returned 1 [0073.890] ReleaseMutex (hMutex=0xb8) returned 1 [0073.890] CloseHandle (hObject=0xb8) returned 1 [0073.890] GetProcessHeap () returned 0x840000 [0073.890] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x30) returned 0x85e100 [0073.890] GetProcessHeap () returned 0x840000 [0073.890] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x85e138 [0073.890] GetVersion () returned 0x1db10106 [0073.890] GetProcessHeap () returned 0x840000 [0073.890] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x85e350 [0073.890] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0073.890] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0073.890] Wow64DisableWow64FsRedirection (in: OldValue=0x1bfa28 | out: OldValue=0x1bfa28*=0x0) returned 1 [0073.890] GetProcessHeap () returned 0x840000 [0073.890] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e350 | out: hHeap=0x840000) returned 1 [0073.890] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x74d40000 [0073.890] GetProcAddress (hModule=0x74d40000, lpProcName="CreateProcessWithTokenW") returned 0x74d8531f [0073.890] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x85e138, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe")) returned 0x1f [0073.890] GetShellWindow () returned 0x100f2 [0073.891] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x1bfa34 | out: lpdwProcessId=0x1bfa34) returned 0x460 [0073.891] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x45c) returned 0xb8 [0073.891] OpenProcessToken (in: ProcessHandle=0xb8, DesiredAccess=0x2000000, TokenHandle=0x1bfa44 | out: TokenHandle=0x1bfa44*=0xbc) returned 1 [0073.891] DuplicateTokenEx (in: hExistingToken=0xbc, dwDesiredAccess=0x2000000, lpTokenAttributes=0x1bfa0c, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x1bfa48 | out: phNewToken=0x1bfa48*=0xc0) returned 1 [0073.891] CreateProcessWithTokenW (in: hToken=0xc0, dwLogonFlags=0x0, lpApplicationName="C:\\Windows\\SysWOW64\\svchost.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1bf9c0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1bfa18 | out: lpCommandLine=0x0, lpProcessInformation=0x1bfa18*(hProcess=0x10c, hThread=0x110, dwProcessId=0xa40, dwThreadId=0xa44)) returned 1 [0074.053] GetProcessHeap () returned 0x840000 [0074.053] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0074.053] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0074.053] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76c4d668 [0074.053] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0074.053] GetProcessHeap () returned 0x840000 [0074.053] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0074.053] CloseHandle (hObject=0xb8) returned 1 [0074.053] CloseHandle (hObject=0x10c) returned 1 [0074.053] CloseHandle (hObject=0x110) returned 1 [0074.053] CloseHandle (hObject=0xbc) returned 1 [0074.053] CloseHandle (hObject=0xc0) returned 1 [0074.053] GetProcessHeap () returned 0x840000 [0074.053] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e138 | out: hHeap=0x840000) returned 1 [0074.053] GetProcessHeap () returned 0x840000 [0074.053] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0074.053] Sleep (dwMilliseconds=0x1388) [0079.061] GetProcessHeap () returned 0x840000 [0079.061] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x60) returned 0x85ef00 [0079.061] GetProcessHeap () returned 0x840000 [0079.061] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85dc88 [0079.061] GetProcessHeap () returned 0x840000 [0079.061] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85de18 [0079.061] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85dd00 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f0f0 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f0f0 | out: hHeap=0x840000) returned 1 [0079.062] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x85de18, nSize=0xf | out: lpDst="") returned 0x2c [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dd00 | out: hHeap=0x840000) returned 1 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85de18, Size=0x3a) returned 0x855210 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x3a) returned 0x855258 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f0f0 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f0f0 | out: hHeap=0x840000) returned 1 [0079.062] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x855210, nSize=0x1d | out: lpDst="") returned 0x2c [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855258 | out: hHeap=0x840000) returned 1 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855210, Size=0x72) returned 0x84f4c8 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x72) returned 0x84f548 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f0f0 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f0f0 | out: hHeap=0x840000) returned 1 [0079.062] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x84f4c8, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f548 | out: hHeap=0x840000) returned 1 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dc88 | out: hHeap=0x840000) returned 1 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855210 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3e) returned 0x855258 [0079.062] GetProcessHeap () returned 0x840000 [0079.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x3e) returned 0x8552a0 [0079.063] GetProcessHeap () returned 0x840000 [0079.063] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f0f0 [0079.063] GetProcessHeap () returned 0x840000 [0079.063] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x10) returned 0x851558 [0079.063] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf92c | out: phkResult=0x1bf92c*=0xbc) returned 0x0 [0079.064] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1bf928, lpData=0x8552a0, lpcbData=0x1bf930*=0x3e | out: lpType=0x1bf928*=0x2, lpData=0x8552a0*=0x53, lpcbData=0x1bf930*=0x98) returned 0xea [0079.064] RegCloseKey (hKey=0xbc) returned 0x0 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851558 | out: hHeap=0x840000) returned 1 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f0f0 | out: hHeap=0x840000) returned 1 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8552a0 | out: hHeap=0x840000) returned 1 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855258, Size=0x7a) returned 0x85f0f0 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x7a) returned 0x85f178 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f200 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x10) returned 0x851558 [0079.064] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf92c | out: phkResult=0x1bf92c*=0xbc) returned 0x0 [0079.064] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1bf928, lpData=0x85f178, lpcbData=0x1bf930*=0x7a | out: lpType=0x1bf928*=0x2, lpData=0x85f178*=0x28, lpcbData=0x1bf930*=0x98) returned 0xea [0079.064] RegCloseKey (hKey=0xbc) returned 0x0 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851558 | out: hHeap=0x840000) returned 1 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f200 | out: hHeap=0x840000) returned 1 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f178 | out: hHeap=0x840000) returned 1 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85f0f0, Size=0xf2) returned 0x85f0f0 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xf2) returned 0x85f428 [0079.064] GetProcessHeap () returned 0x840000 [0079.064] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f1f0 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x10) returned 0x851558 [0079.065] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf92c | out: phkResult=0x1bf92c*=0xbc) returned 0x0 [0079.065] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1bf928, lpData=0x85f428, lpcbData=0x1bf930*=0xf2 | out: lpType=0x1bf928*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1bf930*=0x98) returned 0x0 [0079.065] RegCloseKey (hKey=0xbc) returned 0x0 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851558 | out: hHeap=0x840000) returned 1 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85dc88 [0079.065] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf92c | out: phkResult=0x1bf92c*=0xbc) returned 0x0 [0079.065] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1bf928, lpData=0x85f4c0, lpcbData=0x1bf930*=0x5a | out: lpType=0x1bf928*=0x0, lpData=0x85f4c0*=0x0, lpcbData=0x1bf930*=0x5a) returned 0x2 [0079.065] RegCloseKey (hKey=0xbc) returned 0x0 [0079.065] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf940 | out: phkResult=0x1bf940*=0xbc) returned 0x0 [0079.065] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1bf93c, lpData=0x85f4c0, lpcbData=0x1bf944*=0x5a | out: lpType=0x1bf93c*=0x2, lpData=0x85f4c0*=0x0, lpcbData=0x1bf944*=0x78) returned 0xea [0079.065] RegCloseKey (hKey=0xbc) returned 0x0 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dc88 | out: hHeap=0x840000) returned 1 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f1f0 | out: hHeap=0x840000) returned 1 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f428 | out: hHeap=0x840000) returned 1 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85f0f0, Size=0x1e2) returned 0x85f428 [0079.065] GetProcessHeap () returned 0x840000 [0079.065] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e2) returned 0x8626a8 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85f618 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x10) returned 0x851558 [0079.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf92c | out: phkResult=0x1bf92c*=0xbc) returned 0x0 [0079.066] RegQueryValueExW (in: hKey=0xbc, lpValueName="Startup", lpReserved=0x0, lpType=0x1bf928, lpData=0x8626a8, lpcbData=0x1bf930*=0x1e2 | out: lpType=0x1bf928*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1bf930*=0x98) returned 0x0 [0079.066] RegCloseKey (hKey=0xbc) returned 0x0 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851558 | out: hHeap=0x840000) returned 1 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85dc88 [0079.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf92c | out: phkResult=0x1bf92c*=0xbc) returned 0x0 [0079.066] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1bf928, lpData=0x862740, lpcbData=0x1bf930*=0x14a | out: lpType=0x1bf928*=0x0, lpData=0x862740*=0x2, lpcbData=0x1bf930*=0x14a) returned 0x2 [0079.066] RegCloseKey (hKey=0xbc) returned 0x0 [0079.066] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1bf940 | out: phkResult=0x1bf940*=0xbc) returned 0x0 [0079.066] RegQueryValueExW (in: hKey=0xbc, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1bf93c, lpData=0x862740, lpcbData=0x1bf944*=0x14a | out: lpType=0x1bf93c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1bf944*=0x78) returned 0x0 [0079.066] RegCloseKey (hKey=0xbc) returned 0x0 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dc88 | out: hHeap=0x840000) returned 1 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f618 | out: hHeap=0x840000) returned 1 [0079.066] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x85f428, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8626a8 | out: hHeap=0x840000) returned 1 [0079.066] GetProcessHeap () returned 0x840000 [0079.066] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855210 | out: hHeap=0x840000) returned 1 [0079.066] GetProcessHeap () returned 0x840000 [0079.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x8626a8 [0079.067] GetProcessHeap () returned 0x840000 [0079.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x85e100 [0079.067] GetProcessHeap () returned 0x840000 [0079.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x85e318 [0079.067] GetProcessHeap () returned 0x840000 [0079.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x864410 [0079.067] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8626a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe")) returned 0x1f [0079.067] GetProcessHeap () returned 0x840000 [0079.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x864628 [0079.067] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x864628, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe")) returned 0x1f [0079.067] GetProcessHeap () returned 0x840000 [0079.067] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864628 | out: hHeap=0x840000) returned 1 [0079.067] GetProcessHeap () returned 0x840000 [0079.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x864628 [0079.067] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x864628, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe")) returned 0x1f [0079.067] GetProcessHeap () returned 0x840000 [0079.067] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864628 | out: hHeap=0x840000) returned 1 [0079.067] CopyFileW (lpExistingFileName="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\svchost.exe"), bFailIfExists=0) returned 1 [0079.075] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1bfa28 | out: phkResult=0x1bfa28*=0x110) returned 0x0 [0079.076] RegSetValueExW (in: hKey=0x110, lpValueName="svchost", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe", cbData=0x6e | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe") returned 0x0 [0079.076] RegCloseKey (hKey=0x110) returned 0x0 [0079.076] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1bfa24 | out: phkResult=0x1bfa24*=0x110) returned 0x0 [0079.076] RegSetValueExW (in: hKey=0x110, lpValueName="svchost", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe", cbData=0x6e | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe") returned 0x0 [0079.077] RegCloseKey (hKey=0x110) returned 0x0 [0079.077] GetProcessHeap () returned 0x840000 [0079.077] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x134) returned 0x85f0f0 [0079.077] CopyFileW (lpExistingFileName="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe"), bFailIfExists=1) returned 1 [0079.081] CopyFileW (lpExistingFileName="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe"), bFailIfExists=1) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f0f0 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8626a8 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e318 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864410 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85ef00 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f4c8 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f428 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85dc88 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85de18 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85dd00 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85ef00 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85ef00 | out: hHeap=0x840000) returned 1 [0079.085] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85de18, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dd00 | out: hHeap=0x840000) returned 1 [0079.085] GetProcessHeap () returned 0x840000 [0079.085] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dc88 | out: hHeap=0x840000) returned 1 [0079.085] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1bfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1bfa44*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85de18 | out: hHeap=0x840000) returned 1 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x85eec0 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x851558 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x60) returned 0x85ef00 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x5a) returned 0x85f0f0 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85f0f0, Size=0xb2) returned 0x85f0f0 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x851438 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x180) returned 0x85f428 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x250) returned 0x8626a8 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x862900 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x84) returned 0x85f1b0 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x84) returned 0x85f5b0 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85e100 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0079.086] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x85f1b0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f5b0 | out: hHeap=0x840000) returned 1 [0079.086] GetProcessHeap () returned 0x840000 [0079.086] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x862900 | out: hHeap=0x840000) returned 1 [0079.086] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xc0) returned 0x85f5b0 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb8) returned 0x85e100 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xb8) returned 0x85e1c0 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x862900 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x862900 | out: hHeap=0x840000) returned 1 [0079.087] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x85e100, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e1c0 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f5b0 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x85e1c0 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x864410 [0079.087] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x864410, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe")) returned 0x1f [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864410 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x174) returned 0x85e3d8 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85e3d8, Size=0x3be) returned 0x864410 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x86) returned 0x862900 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x862900, Size=0x9e) returned 0x862900 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xba) returned 0x85f5b0 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e1c0 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f428 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8626a8 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f1b0 | out: hHeap=0x840000) returned 1 [0079.087] GetProcessHeap () returned 0x840000 [0079.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851558 | out: hHeap=0x840000) returned 1 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85ef00 | out: hHeap=0x840000) returned 1 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85de18 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85dc88 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85dd00 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85ef00 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85ef00 | out: hHeap=0x840000) returned 1 [0079.088] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85dc88, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dd00 | out: hHeap=0x840000) returned 1 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85de18 | out: hHeap=0x840000) returned 1 [0079.088] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1bfa44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1bfa44*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dc88 | out: hHeap=0x840000) returned 1 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x862b70 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x851558 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x60) returned 0x85ef00 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x5a) returned 0x85f1b0 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85f1b0, Size=0xb2) returned 0x85f1b0 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x8514f8 [0079.088] GetProcessHeap () returned 0x840000 [0079.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x180) returned 0x85f428 [0079.088] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x250) returned 0x8626a8 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85e100 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x84) returned 0x85e198 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x84) returned 0x85e228 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85e2b8 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e2b8 | out: hHeap=0x840000) returned 1 [0079.089] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x85e198, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e228 | out: hHeap=0x840000) returned 1 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xc0) returned 0x85e228 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb8) returned 0x85e2f0 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xb8) returned 0x85e3b0 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85e100 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e100 | out: hHeap=0x840000) returned 1 [0079.089] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x85e2f0, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e3b0 | out: hHeap=0x840000) returned 1 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e228 | out: hHeap=0x840000) returned 1 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x8647d8 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20a) returned 0x8649f0 [0079.089] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8649f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\svchost.exe" (normalized: "c:\\windows\\syswow64\\svchost.exe")) returned 0x1f [0079.089] GetProcessHeap () returned 0x840000 [0079.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8649f0 | out: hHeap=0x840000) returned 1 [0079.089] GetProcessHeap () returned 0x840000 [0079.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x174) returned 0x85e3b0 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x24e) returned 0x8649f0 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x86) returned 0x85e100 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x85e100, Size=0x9e) returned 0x85e228 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xba) returned 0x864c48 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8647d8 | out: hHeap=0x840000) returned 1 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85f428 | out: hHeap=0x840000) returned 1 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8626a8 | out: hHeap=0x840000) returned 1 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e198 | out: hHeap=0x840000) returned 1 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e2f0 | out: hHeap=0x840000) returned 1 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851558 | out: hHeap=0x840000) returned 1 [0079.090] GetProcessHeap () returned 0x840000 [0079.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85ef00 | out: hHeap=0x840000) returned 1 [0079.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402013, lpParameter=0x1bfa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110 [0079.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401fab, lpParameter=0x1bfa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc [0079.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401e4e, lpParameter=0x1bfa8c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0079.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401859, lpParameter=0x1bfa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0079.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40197c, lpParameter=0x1bfa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114 [0079.095] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0xa34 Thread: id = 6 os_tid = 0xaec [0079.096] GetVersion () returned 0x1db10106 [0079.096] GetCurrentProcess () returned 0xffffffff [0079.096] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcff89c | out: TokenHandle=0xcff89c*=0x118) returned 1 [0079.096] GetTokenInformation (in: TokenHandle=0x118, TokenInformationClass=0x14, TokenInformation=0xcff894, TokenInformationLength=0x4, ReturnLength=0xcff898 | out: TokenInformation=0xcff894, ReturnLength=0xcff898) returned 1 [0079.096] CloseHandle (hObject=0x118) returned 1 [0079.096] GetProcessHeap () returned 0x840000 [0079.096] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85dc88 [0079.096] GetProcessHeap () returned 0x840000 [0079.096] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85de18 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85dd00 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x85ef00 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85ef00 | out: hHeap=0x840000) returned 1 [0079.097] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85de18, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dd00 | out: hHeap=0x840000) returned 1 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dc88 | out: hHeap=0x840000) returned 1 [0079.097] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85de18 | out: hHeap=0x840000) returned 1 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855210 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855258 [0079.097] GetProcessHeap () returned 0x840000 [0079.097] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855258, Size=0x72) returned 0x84f4c8 [0079.097] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0079.097] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x118 [0079.097] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x0 [0079.098] GetProcessHeap () returned 0x840000 [0079.098] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855210 | out: hHeap=0x840000) returned 1 [0079.098] GetProcessHeap () returned 0x840000 [0079.098] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f4c8 | out: hHeap=0x840000) returned 1 [0079.098] ReleaseMutex (hMutex=0x118) returned 1 [0079.098] CloseHandle (hObject=0x118) returned 1 [0079.098] Sleep (dwMilliseconds=0x3e8) [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901328 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9013f0 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9012b0 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0080.488] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9013f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9012b0 | out: hHeap=0x840000) returned 1 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901328 | out: hHeap=0x840000) returned 1 [0080.488] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9013f0 | out: hHeap=0x840000) returned 1 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855570 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x8555b8 [0080.488] GetProcessHeap () returned 0x840000 [0080.488] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8555b8, Size=0x72) returned 0x84f7c8 [0080.488] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0080.488] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1c8 [0080.488] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x0 [0080.489] GetProcessHeap () returned 0x840000 [0080.489] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855570 | out: hHeap=0x840000) returned 1 [0080.489] GetProcessHeap () returned 0x840000 [0080.489] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f7c8 | out: hHeap=0x840000) returned 1 [0080.489] ReleaseMutex (hMutex=0x1c8) returned 1 [0080.489] CloseHandle (hObject=0x1c8) returned 1 [0080.489] Sleep (dwMilliseconds=0x3e8) [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x9015a8 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9015d0 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9015f8 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0081.638] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9015d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9015f8 | out: hHeap=0x840000) returned 1 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9015a8 | out: hHeap=0x840000) returned 1 [0081.638] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9015d0 | out: hHeap=0x840000) returned 1 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x8555b8 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855600 [0081.638] GetProcessHeap () returned 0x840000 [0081.638] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855600, Size=0x72) returned 0x84f948 [0081.638] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0081.639] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1fc [0081.639] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0081.639] GetProcessHeap () returned 0x840000 [0081.639] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8555b8 | out: hHeap=0x840000) returned 1 [0081.639] GetProcessHeap () returned 0x840000 [0081.639] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f948 | out: hHeap=0x840000) returned 1 [0081.639] ReleaseMutex (hMutex=0x1fc) returned 1 [0081.639] CloseHandle (hObject=0x1fc) returned 1 [0081.639] Sleep (dwMilliseconds=0x3e8) [0082.774] GetProcessHeap () returned 0x840000 [0082.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0082.774] GetProcessHeap () returned 0x840000 [0082.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901698 [0082.774] GetProcessHeap () returned 0x840000 [0082.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9016c0 [0082.774] GetProcessHeap () returned 0x840000 [0082.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0082.774] GetProcessHeap () returned 0x840000 [0082.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0082.774] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901698, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.774] GetProcessHeap () returned 0x840000 [0082.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016c0 | out: hHeap=0x840000) returned 1 [0082.774] GetProcessHeap () returned 0x840000 [0082.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0082.774] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.775] GetProcessHeap () returned 0x840000 [0082.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0082.775] GetProcessHeap () returned 0x840000 [0082.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0082.775] GetProcessHeap () returned 0x840000 [0082.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0082.775] GetProcessHeap () returned 0x840000 [0082.775] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f948 [0082.775] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0082.775] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x204 [0082.775] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x0 [0082.775] GetProcessHeap () returned 0x840000 [0082.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0082.775] GetProcessHeap () returned 0x840000 [0082.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f948 | out: hHeap=0x840000) returned 1 [0082.775] ReleaseMutex (hMutex=0x204) returned 1 [0082.775] CloseHandle (hObject=0x204) returned 1 [0082.775] Sleep (dwMilliseconds=0x3e8) [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9016e8 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901698 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0083.929] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9016e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0083.929] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016e8 | out: hHeap=0x840000) returned 1 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0083.929] GetProcessHeap () returned 0x840000 [0083.929] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0083.929] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0083.930] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0083.930] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x0 [0083.930] GetProcessHeap () returned 0x840000 [0083.930] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0083.930] GetProcessHeap () returned 0x840000 [0083.930] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0083.930] ReleaseMutex (hMutex=0x1ac) returned 1 [0083.930] CloseHandle (hObject=0x1ac) returned 1 [0083.930] Sleep (dwMilliseconds=0x3e8) [0085.100] GetProcessHeap () returned 0x840000 [0085.100] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x9016e8 [0085.100] GetProcessHeap () returned 0x840000 [0085.100] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0085.100] GetProcessHeap () returned 0x840000 [0085.100] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901698 [0085.100] GetProcessHeap () returned 0x840000 [0085.100] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0085.100] GetProcessHeap () returned 0x840000 [0085.100] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0085.100] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.100] GetProcessHeap () returned 0x840000 [0085.100] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0085.100] GetProcessHeap () returned 0x840000 [0085.100] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016e8 | out: hHeap=0x840000) returned 1 [0085.100] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.101] GetProcessHeap () returned 0x840000 [0085.101] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0085.101] GetProcessHeap () returned 0x840000 [0085.101] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0085.101] GetProcessHeap () returned 0x840000 [0085.101] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0085.101] GetProcessHeap () returned 0x840000 [0085.101] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0085.101] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0085.101] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0085.101] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x0 [0085.101] GetProcessHeap () returned 0x840000 [0085.101] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0085.101] GetProcessHeap () returned 0x840000 [0085.101] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0085.101] ReleaseMutex (hMutex=0x1ac) returned 1 [0085.101] CloseHandle (hObject=0x1ac) returned 1 [0085.101] Sleep (dwMilliseconds=0x3e8) [0086.174] GetProcessHeap () returned 0x840000 [0086.174] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0086.174] GetProcessHeap () returned 0x840000 [0086.174] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9016e8 [0086.174] GetProcessHeap () returned 0x840000 [0086.174] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901698 [0086.174] GetProcessHeap () returned 0x840000 [0086.174] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0086.174] GetProcessHeap () returned 0x840000 [0086.174] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0086.174] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9016e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0086.175] GetProcessHeap () returned 0x840000 [0086.175] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0086.175] GetProcessHeap () returned 0x840000 [0086.175] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0086.175] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0086.175] GetProcessHeap () returned 0x840000 [0086.175] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016e8 | out: hHeap=0x840000) returned 1 [0086.175] GetProcessHeap () returned 0x840000 [0086.175] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0086.175] GetProcessHeap () returned 0x840000 [0086.175] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0086.175] GetProcessHeap () returned 0x840000 [0086.175] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84fa48 [0086.175] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0086.176] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x210 [0086.176] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x0 [0086.176] GetProcessHeap () returned 0x840000 [0086.176] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0086.176] GetProcessHeap () returned 0x840000 [0086.176] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84fa48 | out: hHeap=0x840000) returned 1 [0086.176] ReleaseMutex (hMutex=0x210) returned 1 [0086.176] CloseHandle (hObject=0x210) returned 1 [0086.176] Sleep (dwMilliseconds=0x3e8) [0087.338] GetProcessHeap () returned 0x840000 [0087.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x9016e8 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901698 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0087.339] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016e8 | out: hHeap=0x840000) returned 1 [0087.339] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0087.339] GetProcessHeap () returned 0x840000 [0087.339] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0087.339] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0087.339] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0087.340] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x0 [0087.340] GetProcessHeap () returned 0x840000 [0087.340] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0087.340] GetProcessHeap () returned 0x840000 [0087.340] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0087.340] ReleaseMutex (hMutex=0x1ac) returned 1 [0087.340] CloseHandle (hObject=0x1ac) returned 1 [0087.340] Sleep (dwMilliseconds=0x3e8) [0088.454] GetProcessHeap () returned 0x840000 [0088.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0088.454] GetProcessHeap () returned 0x840000 [0088.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9016e8 [0088.454] GetProcessHeap () returned 0x840000 [0088.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901698 [0088.454] GetProcessHeap () returned 0x840000 [0088.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0088.454] GetProcessHeap () returned 0x840000 [0088.454] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0088.454] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9016e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0088.455] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016e8 | out: hHeap=0x840000) returned 1 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0088.455] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0088.455] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x21c [0088.455] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0088.455] GetProcessHeap () returned 0x840000 [0088.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0088.455] ReleaseMutex (hMutex=0x21c) returned 1 [0088.455] CloseHandle (hObject=0x21c) returned 1 [0088.455] Sleep (dwMilliseconds=0x3e8) [0089.615] GetProcessHeap () returned 0x840000 [0089.615] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0089.615] GetProcessHeap () returned 0x840000 [0089.615] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901698 [0089.615] GetProcessHeap () returned 0x840000 [0089.615] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901738 [0089.615] GetProcessHeap () returned 0x840000 [0089.615] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0089.615] GetProcessHeap () returned 0x840000 [0089.615] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0089.616] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901698, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0089.616] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901698 | out: hHeap=0x840000) returned 1 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0089.616] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0089.616] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0089.616] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x0 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0089.616] GetProcessHeap () returned 0x840000 [0089.616] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0089.616] ReleaseMutex (hMutex=0x1ac) returned 1 [0089.616] CloseHandle (hObject=0x1ac) returned 1 [0089.617] Sleep (dwMilliseconds=0x3e8) [0090.628] GetProcessHeap () returned 0x840000 [0090.628] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0090.628] GetProcessHeap () returned 0x840000 [0090.628] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901738 [0090.628] GetProcessHeap () returned 0x840000 [0090.628] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901760 [0090.628] GetProcessHeap () returned 0x840000 [0090.628] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0090.628] GetProcessHeap () returned 0x840000 [0090.628] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0090.628] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901738, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0090.628] GetProcessHeap () returned 0x840000 [0090.628] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901760 | out: hHeap=0x840000) returned 1 [0090.628] GetProcessHeap () returned 0x840000 [0090.628] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0090.628] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0090.629] GetProcessHeap () returned 0x840000 [0090.629] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0090.629] GetProcessHeap () returned 0x840000 [0090.629] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0090.629] GetProcessHeap () returned 0x840000 [0090.629] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0090.629] GetProcessHeap () returned 0x840000 [0090.629] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0090.629] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0090.629] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x220 [0090.629] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0 [0090.629] GetProcessHeap () returned 0x840000 [0090.629] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0090.629] GetProcessHeap () returned 0x840000 [0090.629] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0090.629] ReleaseMutex (hMutex=0x220) returned 1 [0090.629] CloseHandle (hObject=0x220) returned 1 [0090.629] Sleep (dwMilliseconds=0x3e8) [0091.686] GetProcessHeap () returned 0x840000 [0091.686] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901738 [0091.686] GetProcessHeap () returned 0x840000 [0091.686] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0091.686] GetProcessHeap () returned 0x840000 [0091.687] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901760 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0091.687] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901760 | out: hHeap=0x840000) returned 1 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0091.687] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0091.687] GetProcessHeap () returned 0x840000 [0091.687] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0091.687] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0091.687] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x208 [0091.687] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x0 [0091.688] GetProcessHeap () returned 0x840000 [0091.688] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0091.688] GetProcessHeap () returned 0x840000 [0091.688] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0091.688] ReleaseMutex (hMutex=0x208) returned 1 [0091.688] CloseHandle (hObject=0x208) returned 1 [0091.688] Sleep (dwMilliseconds=0x3e8) [0092.781] GetProcessHeap () returned 0x840000 [0092.781] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x9010f8 [0092.781] GetProcessHeap () returned 0x840000 [0092.782] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901738 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0092.782] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9010f8 | out: hHeap=0x840000) returned 1 [0092.782] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0092.782] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0092.782] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x214 [0092.782] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x0 [0092.782] GetProcessHeap () returned 0x840000 [0092.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0092.782] GetProcessHeap () returned 0x840000 [0092.783] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0092.783] ReleaseMutex (hMutex=0x214) returned 1 [0092.783] CloseHandle (hObject=0x214) returned 1 [0092.783] Sleep (dwMilliseconds=0x3e8) [0093.804] GetProcessHeap () returned 0x840000 [0093.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85e0c0 [0093.804] GetProcessHeap () returned 0x840000 [0093.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0093.804] GetProcessHeap () returned 0x840000 [0093.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9010f8 [0093.804] GetProcessHeap () returned 0x840000 [0093.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0093.804] GetProcessHeap () returned 0x840000 [0093.804] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0093.804] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0093.804] GetProcessHeap () returned 0x840000 [0093.804] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9010f8 | out: hHeap=0x840000) returned 1 [0093.804] GetProcessHeap () returned 0x840000 [0093.804] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85e0c0 | out: hHeap=0x840000) returned 1 [0093.804] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.805] GetProcessHeap () returned 0x840000 [0093.805] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0093.805] GetProcessHeap () returned 0x840000 [0093.805] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0093.805] GetProcessHeap () returned 0x840000 [0093.805] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0093.805] GetProcessHeap () returned 0x840000 [0093.805] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0093.805] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0093.805] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x19c [0093.805] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x0 [0093.805] GetProcessHeap () returned 0x840000 [0093.805] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0093.805] GetProcessHeap () returned 0x840000 [0093.805] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0093.805] ReleaseMutex (hMutex=0x19c) returned 1 [0093.805] CloseHandle (hObject=0x19c) returned 1 [0093.805] Sleep (dwMilliseconds=0x3e8) [0094.844] GetProcessHeap () returned 0x840000 [0094.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0094.844] GetProcessHeap () returned 0x840000 [0094.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9010f8 [0094.844] GetProcessHeap () returned 0x840000 [0094.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901738 [0094.844] GetProcessHeap () returned 0x840000 [0094.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0094.844] GetProcessHeap () returned 0x840000 [0094.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0094.844] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9010f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.844] GetProcessHeap () returned 0x840000 [0094.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0094.844] GetProcessHeap () returned 0x840000 [0094.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0094.844] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.845] GetProcessHeap () returned 0x840000 [0094.845] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9010f8 | out: hHeap=0x840000) returned 1 [0094.845] GetProcessHeap () returned 0x840000 [0094.845] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0094.845] GetProcessHeap () returned 0x840000 [0094.845] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0094.845] GetProcessHeap () returned 0x840000 [0094.845] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0094.845] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0094.845] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x200 [0094.845] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0094.845] GetProcessHeap () returned 0x840000 [0094.845] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0094.845] GetProcessHeap () returned 0x840000 [0094.845] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0094.845] ReleaseMutex (hMutex=0x200) returned 1 [0094.845] CloseHandle (hObject=0x200) returned 1 [0094.845] Sleep (dwMilliseconds=0x3e8) [0095.902] GetProcessHeap () returned 0x840000 [0095.902] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x9010f8 [0095.902] GetProcessHeap () returned 0x840000 [0095.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901738 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0095.903] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9010f8 | out: hHeap=0x840000) returned 1 [0095.903] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0095.903] GetProcessHeap () returned 0x840000 [0095.903] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0095.903] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0095.903] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x22c [0095.903] WaitForSingleObject (hHandle=0x22c, dwMilliseconds=0x0) returned 0x0 [0095.904] GetProcessHeap () returned 0x840000 [0095.904] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0095.904] GetProcessHeap () returned 0x840000 [0095.904] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0095.904] ReleaseMutex (hMutex=0x22c) returned 1 [0095.904] CloseHandle (hObject=0x22c) returned 1 [0095.904] Sleep (dwMilliseconds=0x3e8) [0096.952] GetProcessHeap () returned 0x840000 [0096.952] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0096.952] GetProcessHeap () returned 0x840000 [0096.952] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901738 [0096.952] GetProcessHeap () returned 0x840000 [0096.952] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9016c0 [0096.952] GetProcessHeap () returned 0x840000 [0096.952] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0096.952] GetProcessHeap () returned 0x840000 [0096.952] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0096.952] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901738, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0096.952] GetProcessHeap () returned 0x840000 [0096.952] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016c0 | out: hHeap=0x840000) returned 1 [0096.952] GetProcessHeap () returned 0x840000 [0096.952] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0096.952] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0096.953] GetProcessHeap () returned 0x840000 [0096.953] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0096.953] GetProcessHeap () returned 0x840000 [0096.953] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0096.953] GetProcessHeap () returned 0x840000 [0096.953] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0096.953] GetProcessHeap () returned 0x840000 [0096.953] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0096.953] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0096.953] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0096.953] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x0 [0096.953] GetProcessHeap () returned 0x840000 [0096.953] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0096.953] GetProcessHeap () returned 0x840000 [0096.953] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0096.953] ReleaseMutex (hMutex=0x1c4) returned 1 [0096.953] CloseHandle (hObject=0x1c4) returned 1 [0096.953] Sleep (dwMilliseconds=0x3e8) [0097.973] GetProcessHeap () returned 0x840000 [0097.973] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901738 [0097.973] GetProcessHeap () returned 0x840000 [0097.973] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901558 [0097.973] GetProcessHeap () returned 0x840000 [0097.973] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9016c0 [0097.973] GetProcessHeap () returned 0x840000 [0097.974] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0097.974] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901558, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016c0 | out: hHeap=0x840000) returned 1 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0097.974] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0097.974] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0097.974] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x194 [0097.974] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x0 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0097.974] GetProcessHeap () returned 0x840000 [0097.974] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0097.974] ReleaseMutex (hMutex=0x194) returned 1 [0097.974] CloseHandle (hObject=0x194) returned 1 [0097.974] Sleep (dwMilliseconds=0x3e8) [0098.984] GetProcessHeap () returned 0x840000 [0098.984] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0098.984] GetProcessHeap () returned 0x840000 [0098.984] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901738 [0098.984] GetProcessHeap () returned 0x840000 [0098.985] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x9016c0 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0098.985] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901738, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016c0 | out: hHeap=0x840000) returned 1 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0098.985] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901738 | out: hHeap=0x840000) returned 1 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0098.985] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0098.985] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x200 [0098.985] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0098.985] GetProcessHeap () returned 0x840000 [0098.985] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0098.985] GetProcessHeap () returned 0x840000 [0098.986] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0098.986] ReleaseMutex (hMutex=0x200) returned 1 [0098.986] CloseHandle (hObject=0x200) returned 1 [0098.986] Sleep (dwMilliseconds=0x3e8) [0100.027] GetProcessHeap () returned 0x840000 [0100.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x9016c0 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901760 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0100.027] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x9016c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901760 | out: hHeap=0x840000) returned 1 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0100.027] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x9016c0 | out: hHeap=0x840000) returned 1 [0100.027] GetProcessHeap () returned 0x840000 [0100.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0100.027] GetProcessHeap () returned 0x840000 [0100.028] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0100.028] GetProcessHeap () returned 0x840000 [0100.028] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0100.028] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0100.028] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x228 [0100.028] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x0 [0100.028] GetProcessHeap () returned 0x840000 [0100.028] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0100.028] GetProcessHeap () returned 0x840000 [0100.028] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0100.028] ReleaseMutex (hMutex=0x228) returned 1 [0100.028] CloseHandle (hObject=0x228) returned 1 [0100.028] Sleep (dwMilliseconds=0x3e8) [0101.268] GetProcessHeap () returned 0x840000 [0101.268] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x901558 [0101.268] GetProcessHeap () returned 0x840000 [0101.268] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x901760 [0101.268] GetProcessHeap () returned 0x840000 [0101.268] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x901788 [0101.268] GetProcessHeap () returned 0x840000 [0101.268] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a778 [0101.268] GetProcessHeap () returned 0x840000 [0101.268] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a778 | out: hHeap=0x840000) returned 1 [0101.268] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x901760, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.268] GetProcessHeap () returned 0x840000 [0101.268] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901788 | out: hHeap=0x840000) returned 1 [0101.268] GetProcessHeap () returned 0x840000 [0101.268] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901558 | out: hHeap=0x840000) returned 1 [0101.268] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcff824, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcff824*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.269] GetProcessHeap () returned 0x840000 [0101.269] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x901760 | out: hHeap=0x840000) returned 1 [0101.269] GetProcessHeap () returned 0x840000 [0101.269] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855600 [0101.269] GetProcessHeap () returned 0x840000 [0101.269] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x3a) returned 0x855648 [0101.269] GetProcessHeap () returned 0x840000 [0101.269] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855648, Size=0x72) returned 0x84f9c8 [0101.269] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0101.269] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0x210 [0101.269] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x0 [0101.269] GetProcessHeap () returned 0x840000 [0101.269] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x855600 | out: hHeap=0x840000) returned 1 [0101.269] GetProcessHeap () returned 0x840000 [0101.269] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f9c8 | out: hHeap=0x840000) returned 1 [0101.269] ReleaseMutex (hMutex=0x210) returned 1 [0101.269] CloseHandle (hObject=0x210) returned 1 [0101.269] Sleep (dwMilliseconds=0x3e8) Thread: id = 7 os_tid = 0xaf0 [0079.098] GetProcessHeap () returned 0x840000 [0079.098] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x440) returned 0x864d10 [0079.098] GetProcessHeap () returned 0x840000 [0079.098] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x434) returned 0x865158 [0079.098] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0079.101] Process32FirstW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.102] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.102] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.103] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.103] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.103] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.104] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.104] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.105] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.105] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.105] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.106] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.106] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.107] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.107] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.107] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.108] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.108] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.109] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.109] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.110] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.110] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.111] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.111] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0079.111] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.112] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0079.112] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0079.113] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0079.113] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0079.113] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0079.114] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0079.114] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0079.115] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0079.115] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0079.115] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0079.116] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0079.116] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0079.117] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0079.117] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0079.117] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0079.118] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0079.118] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0079.119] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.119] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.120] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.120] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0079.120] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.121] Process32NextW (in: hSnapshot=0x118, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0079.121] CloseHandle (hObject=0x118) returned 1 [0079.121] Sleep (dwMilliseconds=0x1f4) [0080.037] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0080.039] Process32FirstW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.040] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0080.040] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0080.041] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.041] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0080.041] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.042] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0080.042] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0080.043] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0080.043] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0080.044] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.044] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.044] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.045] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.045] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.046] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.046] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.046] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.047] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0080.047] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.048] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.048] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.049] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.049] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0080.049] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.050] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0080.050] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0080.051] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0080.051] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0080.051] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0080.052] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0080.052] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0080.053] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0080.053] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0080.053] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0080.054] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0080.054] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0080.055] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0080.055] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0080.056] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0080.056] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0080.056] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0080.057] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.057] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.058] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.058] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0080.058] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.059] Process32NextW (in: hSnapshot=0x1c8, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0080.059] CloseHandle (hObject=0x1c8) returned 1 [0080.059] Sleep (dwMilliseconds=0x1f4) [0080.684] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0080.686] Process32FirstW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.686] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0080.687] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0080.687] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.687] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0080.688] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.688] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0080.689] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0080.689] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0080.689] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0080.690] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.690] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.691] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.691] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.691] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.692] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.692] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.693] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.693] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0080.694] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.694] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.694] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.695] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.695] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0080.696] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.696] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0080.696] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0080.697] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0080.697] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0080.698] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0080.698] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0080.698] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0080.699] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0080.699] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0080.700] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0080.700] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0080.701] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0080.701] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0080.701] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0080.702] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0080.702] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0080.703] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0080.703] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.703] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.704] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.704] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0080.705] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.705] Process32NextW (in: hSnapshot=0x1dc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0080.705] CloseHandle (hObject=0x1dc) returned 1 [0080.705] Sleep (dwMilliseconds=0x1f4) [0081.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0081.345] Process32FirstW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.345] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0081.346] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0081.346] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.346] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0081.347] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.347] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0081.348] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0081.348] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0081.348] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0081.349] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.349] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.350] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.350] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.350] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.351] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0081.351] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.352] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.352] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0081.352] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0081.353] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0081.353] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.354] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.354] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0081.355] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.355] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0081.355] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0081.356] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0081.356] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0081.357] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0081.357] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0081.357] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0081.358] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0081.358] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0081.359] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0081.359] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0081.359] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0081.360] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0081.360] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0081.361] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0081.361] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0081.362] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0081.362] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.362] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.363] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.363] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0081.364] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.364] Process32NextW (in: hSnapshot=0x198, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0081.364] CloseHandle (hObject=0x198) returned 1 [0081.364] Sleep (dwMilliseconds=0x1f4) [0082.057] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0082.059] Process32FirstW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.059] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0082.060] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0082.060] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.060] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0082.061] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.061] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0082.062] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0082.062] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0082.063] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0082.063] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.063] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.064] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.064] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.065] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.065] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0082.065] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.066] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.066] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0082.067] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0082.067] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0082.068] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.068] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.068] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0082.069] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.069] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0082.070] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0082.070] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0082.071] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0082.071] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0082.072] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0082.072] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0082.073] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0082.073] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0082.073] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0082.074] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0082.074] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0082.075] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0082.075] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0082.076] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0082.076] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0082.076] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0082.077] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0082.077] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.078] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.078] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0082.079] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.079] Process32NextW (in: hSnapshot=0x1fc, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0082.079] CloseHandle (hObject=0x1fc) returned 1 [0082.080] Sleep (dwMilliseconds=0x1f4) [0082.717] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0082.719] Process32FirstW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.719] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0082.720] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0082.720] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.721] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0082.721] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.721] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0082.722] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0082.722] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0082.723] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0082.723] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.723] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.724] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.724] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.725] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.725] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0082.726] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.726] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.726] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0082.727] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0082.727] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0082.728] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.728] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.729] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0082.729] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.729] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0082.730] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0082.730] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0082.731] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0082.731] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0082.732] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0082.732] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0082.732] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0082.733] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0082.733] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0082.734] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0082.734] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0082.735] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0082.735] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0082.735] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0082.736] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0082.736] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0082.737] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0082.737] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.737] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.738] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0082.738] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.739] Process32NextW (in: hSnapshot=0x204, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0082.739] CloseHandle (hObject=0x204) returned 1 [0082.739] Sleep (dwMilliseconds=0x1f4) [0083.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0083.355] Process32FirstW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.355] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0083.356] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0083.356] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.357] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0083.357] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.357] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0083.358] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0083.358] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0083.359] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0083.359] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.360] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.360] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.361] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.361] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.362] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0083.362] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.363] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.363] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0083.363] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0083.364] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0083.364] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.365] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.365] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0083.366] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.366] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0083.367] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0083.367] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0083.368] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0083.368] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0083.369] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0083.369] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0083.370] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0083.370] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0083.370] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0083.371] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0083.371] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0083.372] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0083.372] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0083.373] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0083.373] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0083.374] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0083.374] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0083.375] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.375] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.376] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0083.376] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.376] Process32NextW (in: hSnapshot=0x20c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0083.377] CloseHandle (hObject=0x20c) returned 1 [0083.377] Sleep (dwMilliseconds=0x1f4) [0083.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0083.995] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0083.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0083.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0083.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0083.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0083.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0083.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0083.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0084.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0084.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0084.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0084.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0084.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0084.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0084.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0084.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0084.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0084.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0084.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0084.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0084.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0084.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0084.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0084.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0084.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0084.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0084.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0084.015] CloseHandle (hObject=0x1ac) returned 1 [0084.015] Sleep (dwMilliseconds=0x1f4) [0084.615] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0084.617] Process32FirstW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.617] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0084.618] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0084.618] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.619] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0084.619] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.619] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0084.620] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0084.620] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0084.621] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0084.621] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.622] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.622] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.622] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.623] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.623] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.624] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.624] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.624] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.625] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.625] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.626] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.626] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.626] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0084.627] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.627] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0084.628] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0084.628] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0084.629] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0084.629] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0084.629] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0084.630] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0084.630] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0084.680] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0084.680] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0084.681] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0084.681] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0084.682] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0084.682] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0084.682] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0084.683] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0084.683] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0084.684] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.684] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.684] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.685] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0084.685] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.686] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0084.686] CloseHandle (hObject=0x200) returned 1 [0084.686] Sleep (dwMilliseconds=0x1f4) [0085.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0085.335] Process32FirstW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.335] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0085.335] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0085.336] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.336] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0085.337] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.337] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0085.338] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0085.338] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0085.338] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0085.339] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.339] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.340] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.340] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.340] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.341] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0085.341] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.342] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.342] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0085.342] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0085.343] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0085.343] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0085.344] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.344] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0085.345] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0085.345] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0085.345] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0085.346] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0085.346] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0085.347] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0085.347] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0085.347] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0085.348] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0085.348] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0085.349] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0085.349] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0085.349] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0085.350] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0085.350] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0085.351] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0085.351] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0085.352] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0085.352] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0085.352] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.353] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.353] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0085.354] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.354] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0085.354] CloseHandle (hObject=0x214) returned 1 [0085.355] Sleep (dwMilliseconds=0x1f4) [0085.989] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0085.991] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.991] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0085.992] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0085.992] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.993] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0085.993] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.994] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0085.994] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0085.994] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0085.995] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0085.995] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0085.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0085.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0086.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0086.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0086.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0086.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0086.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0086.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0086.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0086.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0086.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0086.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0086.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0086.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0086.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0086.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0086.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0086.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0086.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0086.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0086.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0086.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0086.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0086.011] CloseHandle (hObject=0x1ac) returned 1 [0086.011] Sleep (dwMilliseconds=0x1f4) [0086.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0086.645] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.645] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0086.646] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0086.646] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.647] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0086.647] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.648] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0086.648] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0086.649] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0086.649] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0086.649] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.650] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.650] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.651] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.651] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.651] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0086.652] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.652] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.653] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0086.653] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0086.653] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0086.654] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.654] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.655] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0086.655] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.656] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0086.656] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0086.656] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0086.657] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0086.657] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0086.658] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0086.658] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0086.664] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0086.664] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0086.665] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0086.665] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0086.666] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0086.666] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0086.666] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0086.667] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0086.667] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0086.668] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0086.668] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.668] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.669] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.669] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0086.670] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.670] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0086.671] CloseHandle (hObject=0x1ac) returned 1 [0086.671] Sleep (dwMilliseconds=0x1f4) [0087.314] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0087.316] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.316] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0087.317] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0087.317] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.320] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0087.320] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.321] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0087.321] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0087.321] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0087.322] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0087.322] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.323] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.323] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.324] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.324] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.324] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0087.325] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.325] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.326] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0087.326] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0087.326] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0087.327] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0087.327] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.328] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0087.328] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0087.328] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0087.329] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0087.329] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0087.330] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0087.330] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0087.331] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0087.331] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0087.332] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0087.332] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0087.332] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0087.333] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0087.333] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0087.334] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0087.334] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0087.334] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0087.335] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0087.335] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0087.336] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0087.336] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.337] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.337] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0087.337] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.338] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0087.338] CloseHandle (hObject=0x1ac) returned 1 [0087.338] Sleep (dwMilliseconds=0x1f4) [0088.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0088.028] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.028] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.029] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.029] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.030] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.030] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.031] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.031] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.031] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.032] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0088.032] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.033] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.033] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.034] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.034] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.034] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.035] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.035] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.036] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.036] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.036] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.037] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.037] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.038] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0088.038] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.039] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0088.039] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0088.039] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0088.040] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0088.040] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0088.041] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0088.041] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0088.042] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0088.042] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0088.042] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0088.043] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0088.043] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0088.044] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0088.044] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0088.044] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0088.045] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0088.045] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0088.046] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.046] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.046] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.047] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0088.047] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.048] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0088.048] CloseHandle (hObject=0x1ac) returned 1 [0088.048] Sleep (dwMilliseconds=0x1f4) [0088.600] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220 [0088.602] Process32FirstW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.603] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.603] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.603] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.604] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.604] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.606] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.607] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.607] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.608] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0088.608] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.608] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.609] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.609] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.610] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.610] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.611] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.611] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.611] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.612] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.612] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.613] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.613] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.614] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0088.614] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.614] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0088.615] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0088.615] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0088.616] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0088.616] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0088.617] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0088.617] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0088.617] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0088.618] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0088.618] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0088.619] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0088.619] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0088.620] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0088.620] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0088.620] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0088.621] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0088.621] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0088.622] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.622] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.623] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.623] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0088.623] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.624] Process32NextW (in: hSnapshot=0x220, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0088.626] CloseHandle (hObject=0x220) returned 1 [0088.626] Sleep (dwMilliseconds=0x1f4) [0089.249] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0089.251] Process32FirstW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.252] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.252] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.253] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.253] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.253] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.254] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.254] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.255] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.255] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0089.256] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.256] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.256] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.257] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.257] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.258] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.258] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.258] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.259] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.259] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.260] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.260] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.260] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.261] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0089.261] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.262] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0089.262] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0089.263] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0089.263] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0089.264] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0089.264] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0089.265] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0089.265] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0089.265] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0089.266] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0089.267] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0089.267] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0089.268] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0089.268] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0089.269] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0089.269] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0089.270] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0089.270] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.271] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.271] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.272] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0089.273] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.273] Process32NextW (in: hSnapshot=0x224, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0089.274] CloseHandle (hObject=0x224) returned 1 [0089.274] Sleep (dwMilliseconds=0x1f4) [0089.859] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0089.861] Process32FirstW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.861] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.862] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.862] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.862] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.863] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.863] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.864] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.864] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.865] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0089.865] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.865] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.866] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.866] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.867] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.867] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.868] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.868] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.868] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.869] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.869] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.870] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.870] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.870] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0089.871] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.871] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0089.872] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0089.873] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0089.873] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0089.873] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0089.874] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0089.874] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0089.875] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0089.875] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0089.875] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0089.876] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0089.876] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0089.877] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0089.877] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0089.878] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0089.878] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0089.878] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0089.879] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.879] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.880] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.880] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0089.881] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.881] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0089.881] CloseHandle (hObject=0x210) returned 1 [0089.881] Sleep (dwMilliseconds=0x1f4) [0090.419] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0090.421] Process32FirstW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.421] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0090.422] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0090.422] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.422] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0090.423] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.423] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0090.424] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0090.424] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0090.425] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0090.425] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.425] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.426] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.426] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.427] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.427] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0090.427] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.428] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.428] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0090.429] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0090.429] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0090.430] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0090.430] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.430] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0090.431] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0090.431] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0090.432] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0090.432] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0090.433] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0090.433] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0090.434] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0090.434] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0090.435] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0090.435] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0090.435] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0090.436] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0090.436] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0090.437] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0090.437] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0090.437] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0090.438] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0090.438] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0090.439] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0090.439] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.440] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.440] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0090.440] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.441] Process32NextW (in: hSnapshot=0x21c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0090.441] CloseHandle (hObject=0x21c) returned 1 [0090.441] Sleep (dwMilliseconds=0x1f4) [0090.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0090.992] Process32FirstW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.992] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0090.995] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0090.995] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.996] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0090.996] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.997] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0090.997] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0090.997] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0090.998] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0090.998] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.999] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.999] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.000] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.000] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.000] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.001] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.001] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.002] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.002] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.003] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.003] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.003] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.004] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0091.004] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.005] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0091.005] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0091.006] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0091.006] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0091.006] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0091.007] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0091.007] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0091.008] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0091.008] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0091.009] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0091.009] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0091.009] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0091.010] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0091.011] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0091.011] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0091.012] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0091.012] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0091.012] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.013] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.013] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.014] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0091.014] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.015] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0091.015] CloseHandle (hObject=0x19c) returned 1 [0091.015] Sleep (dwMilliseconds=0x1f4) [0091.609] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0091.612] Process32FirstW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.612] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.613] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.613] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.614] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.614] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.615] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.615] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.615] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.616] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0091.616] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.617] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.617] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.618] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.618] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.618] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.619] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.619] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.620] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.620] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.621] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.621] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.622] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.622] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0091.622] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.623] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0091.623] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0091.624] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0091.624] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0091.625] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0091.625] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0091.625] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0091.626] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0091.626] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0091.627] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0091.627] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0091.628] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0091.628] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0091.628] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0091.629] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0091.629] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0091.630] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0091.630] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.630] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.631] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.631] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0091.632] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.632] Process32NextW (in: hSnapshot=0x208, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0091.633] CloseHandle (hObject=0x208) returned 1 [0091.633] Sleep (dwMilliseconds=0x1f4) [0092.218] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0092.220] Process32FirstW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.221] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0092.221] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0092.225] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.225] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0092.225] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.226] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0092.226] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0092.227] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0092.227] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0092.228] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.228] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.229] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.229] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.230] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.230] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0092.230] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.231] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.231] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0092.232] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.232] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0092.233] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0092.233] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.233] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0092.234] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0092.234] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0092.235] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0092.235] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0092.235] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0092.236] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0092.236] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0092.237] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0092.237] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0092.238] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0092.238] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0092.238] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0092.239] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0092.239] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0092.240] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0092.240] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0092.241] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0092.241] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0092.241] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.242] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.242] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.243] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0092.243] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.244] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0092.244] CloseHandle (hObject=0x228) returned 1 [0092.244] Sleep (dwMilliseconds=0x1f4) [0092.855] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0092.857] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.857] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0092.858] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0092.859] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.859] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0092.859] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.860] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0092.860] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0092.861] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0092.861] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0092.861] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.862] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.862] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.863] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.863] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.864] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0092.864] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.864] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.865] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0092.865] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.866] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0092.866] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0092.866] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.867] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0092.868] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0092.868] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0092.868] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0092.869] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0092.869] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0092.870] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0092.870] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0092.871] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0092.871] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0092.871] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0092.872] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0092.872] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0092.873] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0092.873] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0092.873] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0092.874] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0092.874] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0092.875] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0092.875] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.876] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.876] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.876] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0092.877] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.877] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0092.878] CloseHandle (hObject=0x1ac) returned 1 [0092.878] Sleep (dwMilliseconds=0x1f4) [0093.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0093.384] Process32FirstW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.385] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.385] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.386] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.386] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.387] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.388] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.388] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.389] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.389] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0093.389] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.390] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.390] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.391] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.391] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.392] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.392] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.392] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.393] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.393] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.394] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.394] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.394] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.395] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0093.395] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.396] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0093.396] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0093.397] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0093.397] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0093.398] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0093.398] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0093.398] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0093.399] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0093.399] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0093.400] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0093.400] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0093.401] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0093.405] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0093.406] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0093.406] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0093.406] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0093.407] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0093.407] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.408] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.408] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.409] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0093.409] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.409] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0093.410] CloseHandle (hObject=0x218) returned 1 [0093.410] Sleep (dwMilliseconds=0x1f4) [0093.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0093.921] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.921] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.922] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.922] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.923] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.923] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.924] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.924] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.924] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.925] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0093.925] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.926] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.926] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.927] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.927] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.927] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.928] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.928] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.929] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.929] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.930] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.930] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.930] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.931] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0093.931] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.932] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0093.932] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0093.932] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0093.933] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0093.933] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0093.934] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0093.934] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0093.935] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0093.935] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0093.935] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0093.936] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0093.936] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0093.937] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0093.937] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0093.937] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0093.938] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0093.938] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0093.939] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.939] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.939] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.940] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0093.940] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.941] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0093.941] CloseHandle (hObject=0x1c4) returned 1 [0093.941] Sleep (dwMilliseconds=0x1f4) [0094.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0094.448] Process32FirstW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.448] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.451] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.451] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.452] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.452] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.453] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.453] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.453] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.454] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0094.454] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.455] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.455] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.456] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.456] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.456] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.457] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.457] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.458] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.458] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.459] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.459] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.459] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.460] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0094.460] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.461] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0094.461] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0094.461] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0094.462] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0094.462] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0094.463] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0094.463] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0094.464] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0094.464] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0094.464] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0094.465] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0094.465] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0094.466] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0094.466] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0094.466] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0094.467] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0094.467] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0094.468] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.468] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.468] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.469] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0094.469] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.470] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0094.470] CloseHandle (hObject=0x228) returned 1 [0094.470] Sleep (dwMilliseconds=0x1f4) [0094.986] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0094.988] Process32FirstW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.988] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.989] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.989] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.990] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.990] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.991] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.991] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.991] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.992] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0094.992] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.993] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.993] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.994] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.994] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.994] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.995] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.995] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.996] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.996] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.996] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.997] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.997] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.998] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0094.998] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.999] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0094.999] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0094.999] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0095.000] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0095.000] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0095.001] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0095.001] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0095.002] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0095.002] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0095.002] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0095.003] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0095.003] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0095.004] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0095.004] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0095.005] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0095.005] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0095.006] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0095.006] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0095.006] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.007] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.007] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0095.008] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.008] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0095.008] CloseHandle (hObject=0x214) returned 1 [0095.009] Sleep (dwMilliseconds=0x1f4) [0095.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0095.529] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0095.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0095.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.531] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0095.531] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.532] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0095.532] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0095.532] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0095.533] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0095.533] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.534] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.534] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.535] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.535] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.535] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0095.536] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.536] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.537] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0095.537] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0095.537] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0095.538] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.538] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.539] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0095.539] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.540] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0095.540] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0095.540] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0095.541] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0095.541] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0095.542] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0095.542] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0095.542] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0095.543] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0095.543] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0095.544] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0095.544] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0095.544] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0095.545] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0095.545] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0095.546] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0095.546] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0095.547] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0095.547] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.547] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.548] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0095.548] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.549] Process32NextW (in: hSnapshot=0x1c4, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0095.549] CloseHandle (hObject=0x1c4) returned 1 [0095.549] Sleep (dwMilliseconds=0x1f4) [0096.058] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0096.060] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.060] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.061] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.061] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.062] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.062] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.062] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.063] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.063] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.064] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0096.064] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.064] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.065] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.065] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.066] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.066] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.067] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.067] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.068] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.068] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.068] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.069] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.069] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.070] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0096.070] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.071] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0096.071] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0096.071] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0096.072] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0096.072] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0096.073] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0096.073] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0096.073] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0096.074] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0096.074] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0096.075] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0096.075] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0096.075] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0096.076] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0096.076] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0096.077] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0096.077] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0096.077] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.078] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.078] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.079] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0096.079] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.080] Process32NextW (in: hSnapshot=0x1ac, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0096.080] CloseHandle (hObject=0x1ac) returned 1 [0096.080] Sleep (dwMilliseconds=0x1f4) [0096.587] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0096.588] Process32FirstW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.589] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.589] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.590] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.590] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.591] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.591] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.592] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.592] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.592] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0096.593] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.593] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.594] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.594] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.595] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.595] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.595] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.596] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.596] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.597] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.597] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.598] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.598] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.599] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0096.599] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.599] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0096.600] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0096.600] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0096.601] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0096.601] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0096.602] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0096.602] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0096.602] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0096.603] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0096.603] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0096.604] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0096.604] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0096.604] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0096.605] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0096.605] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0096.606] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0096.606] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0096.607] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.607] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.607] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.608] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0096.608] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.609] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0096.609] CloseHandle (hObject=0x214) returned 1 [0096.609] Sleep (dwMilliseconds=0x1f4) [0097.134] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0097.136] Process32FirstW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.137] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.137] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.138] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.138] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.138] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.139] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.139] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.140] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.140] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0097.140] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.141] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.141] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.142] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.142] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.143] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0097.143] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.143] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.144] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.144] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0097.145] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.145] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.145] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.146] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0097.146] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.147] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0097.147] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0097.148] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0097.148] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0097.148] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0097.149] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0097.149] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0097.150] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0097.150] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0097.150] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0097.151] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0097.151] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0097.152] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0097.152] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0097.152] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0097.153] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0097.153] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0097.154] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.154] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.155] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.155] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0097.155] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.156] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0097.156] CloseHandle (hObject=0x228) returned 1 [0097.156] Sleep (dwMilliseconds=0x1f4) [0097.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0097.678] Process32FirstW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.679] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.679] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.680] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.680] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.681] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.681] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.681] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.682] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.682] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0097.683] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.683] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.683] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.684] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.684] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.685] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0097.685] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.686] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.686] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.686] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0097.687] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.687] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.688] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.688] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0097.689] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.689] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0097.689] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0097.690] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0097.690] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0097.691] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0097.691] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0097.692] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0097.692] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0097.692] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0097.693] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0097.693] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0097.694] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0097.694] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0097.694] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0097.695] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0097.695] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0097.696] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0097.696] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.697] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.697] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.697] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0097.698] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.698] Process32NextW (in: hSnapshot=0x214, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0097.699] CloseHandle (hObject=0x214) returned 1 [0097.699] Sleep (dwMilliseconds=0x1f4) [0098.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0098.238] Process32FirstW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.238] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0098.239] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0098.239] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.239] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0098.240] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.240] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0098.241] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0098.241] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0098.242] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0098.242] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.242] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.243] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.243] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.244] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.244] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0098.245] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.245] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.245] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0098.246] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0098.246] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0098.247] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.247] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.247] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0098.248] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.248] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0098.249] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0098.249] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0098.249] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0098.250] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0098.250] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0098.251] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0098.251] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0098.252] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0098.252] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0098.252] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0098.253] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0098.253] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0098.254] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0098.254] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0098.255] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0098.255] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0098.255] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.256] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.256] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.257] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0098.257] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.257] Process32NextW (in: hSnapshot=0x218, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0098.258] CloseHandle (hObject=0x218) returned 1 [0098.258] Sleep (dwMilliseconds=0x1f4) [0098.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0098.858] Process32FirstW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.858] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0098.859] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0098.859] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.859] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0098.860] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.860] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0098.861] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0098.861] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0098.862] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0098.862] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.862] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.863] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.863] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.864] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.864] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0098.864] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.865] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.865] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0098.866] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0098.866] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0098.867] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.867] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.867] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0098.868] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.868] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0098.869] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0098.869] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0098.869] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0098.870] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0098.870] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0098.871] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0098.871] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0098.871] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0098.872] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0098.872] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0098.873] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0098.873] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0098.874] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0098.874] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0098.874] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0098.875] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0098.875] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.876] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.876] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.877] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0098.877] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.877] Process32NextW (in: hSnapshot=0x19c, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0098.878] CloseHandle (hObject=0x19c) returned 1 [0098.878] Sleep (dwMilliseconds=0x1f4) [0099.428] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0099.430] Process32FirstW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.431] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0099.431] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0099.432] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.432] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0099.433] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.433] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0099.433] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0099.434] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.434] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0099.435] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.435] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.436] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.436] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.437] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.437] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.438] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.438] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.438] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.439] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.439] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.440] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0099.440] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.441] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0099.441] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0099.442] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0099.442] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0099.442] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0099.443] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0099.443] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0099.444] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0099.444] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0099.445] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0099.445] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0099.446] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0099.446] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0099.446] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0099.447] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0099.447] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0099.448] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0099.448] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0099.449] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0099.449] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.449] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.450] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.450] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0099.451] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.451] Process32NextW (in: hSnapshot=0x200, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0099.452] CloseHandle (hObject=0x200) returned 1 [0099.452] Sleep (dwMilliseconds=0x1f4) [0100.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0100.005] Process32FirstW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.006] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.006] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.007] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.007] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.007] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.008] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.008] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.009] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.009] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0100.010] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.010] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.010] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.011] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.011] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.012] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.012] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.013] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.013] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.014] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.014] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.014] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.015] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.015] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0100.016] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.016] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0100.016] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0100.017] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0100.017] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0100.018] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0100.018] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0100.019] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0100.019] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0100.019] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0100.020] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0100.020] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0100.021] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0100.021] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0100.022] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0100.022] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0100.022] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0100.023] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0100.023] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.024] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.024] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.025] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0100.025] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.026] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0100.026] CloseHandle (hObject=0x228) returned 1 [0100.026] Sleep (dwMilliseconds=0x1f4) [0100.548] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0100.550] Process32FirstW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.551] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.551] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.552] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.552] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.552] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.553] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.553] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.554] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.554] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0100.555] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.555] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.555] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.556] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.556] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.557] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.557] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.557] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.558] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.559] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.559] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.559] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.560] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.560] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0100.561] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.561] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0100.562] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0100.562] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0100.562] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0100.563] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0100.563] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0100.564] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0100.564] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0100.564] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0100.565] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0100.565] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0100.566] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0100.566] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0100.566] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0100.567] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0100.567] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0100.568] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0100.568] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.569] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.569] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.569] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0100.570] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.570] Process32NextW (in: hSnapshot=0x228, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0100.571] CloseHandle (hObject=0x228) returned 1 [0100.571] Sleep (dwMilliseconds=0x1f4) [0101.269] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0101.271] Process32FirstW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.272] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.272] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.273] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.273] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.273] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.274] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.274] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.275] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.275] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0101.276] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.276] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.277] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.277] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.277] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.278] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.278] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.279] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.279] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.279] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.280] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.280] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.281] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.281] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0101.281] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.282] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrange firewire.exe")) returned 1 [0101.282] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="feeds necessity.exe")) returned 1 [0101.283] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="header focuses develop.exe")) returned 1 [0101.283] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="firescontractor.exe")) returned 1 [0101.283] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="briefs.exe")) returned 1 [0101.284] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="advisor groups alabama.exe")) returned 1 [0101.284] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb pulse companion.exe")) returned 1 [0101.285] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bits-slim.exe")) returned 1 [0101.285] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wr-astrology.exe")) returned 1 [0101.286] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="affairs-laundry.exe")) returned 1 [0101.286] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="threshold.exe")) returned 1 [0101.286] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="side_fault.exe")) returned 1 [0101.287] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="images strict.exe")) returned 1 [0101.287] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="consider.exe")) returned 1 [0101.288] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="biggest dimensional sen.exe")) returned 1 [0101.288] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contracts-picture-starsmerchant.exe")) returned 1 [0101.288] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="workshops they.exe")) returned 1 [0101.289] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0101.289] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.290] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x90c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.290] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0101.290] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.291] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0101.292] Process32NextW (in: hSnapshot=0x210, lppe=0xd6fa9c | out: lppe=0xd6fa9c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0101.293] CloseHandle (hObject=0x210) returned 1 [0101.293] Sleep (dwMilliseconds=0x1f4) Thread: id = 8 os_tid = 0xaf4 [0079.121] GetProcessHeap () returned 0x840000 [0079.121] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x21a) returned 0x8657a8 [0079.121] GetProcessHeap () returned 0x840000 [0079.122] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x85e530 [0079.122] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x118 [0079.122] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x11c [0079.122] GetComputerNameW (in: lpBuffer=0x8657b8, nSize=0x229f8b4 | out: lpBuffer="XDUWTFONO", nSize=0x229f8b4) returned 1 [0079.122] GetProcessHeap () returned 0x840000 [0079.122] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x26) returned 0x8628b8 [0079.122] GetProcessHeap () returned 0x840000 [0079.122] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4000) returned 0x8659d0 [0079.122] GetProcessHeap () returned 0x840000 [0079.122] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8699d8 [0079.123] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x229f86c | out: lphEnum=0x229f86c*=0x8634d8) returned 0x0 [0082.200] WNetEnumResourceW (in: hEnum=0x8634d8, lpcCount=0x229f860, lpBuffer=0x8659d0, lpBufferSize=0x229f874 | out: lpcCount=0x229f860, lpBuffer=0x8659d0, lpBufferSize=0x229f874) returned 0x103 [0082.200] WNetCloseEnum (hEnum=0x8634d8) returned 0x0 [0082.200] GetProcessHeap () returned 0x840000 [0082.200] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8659d0 | out: hHeap=0x840000) returned 1 [0082.200] GetProcessHeap () returned 0x840000 [0082.200] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8699d8 | out: hHeap=0x840000) returned 1 [0082.200] GetProcessHeap () returned 0x840000 [0082.200] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4000) returned 0x2b12fd0 [0082.200] GetProcessHeap () returned 0x840000 [0082.200] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8659d0 [0082.200] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x229f854 | out: lphEnum=0x229f854*=0x8621a0) returned 0x0 [0082.200] WNetEnumResourceW (in: hEnum=0x8621a0, lpcCount=0x229f848, lpBuffer=0x2b12fd0, lpBufferSize=0x229f85c | out: lpcCount=0x229f848, lpBuffer=0x2b12fd0, lpBufferSize=0x229f85c) returned 0x103 [0082.200] WNetCloseEnum (hEnum=0x8621a0) returned 0x0 [0082.201] GetProcessHeap () returned 0x840000 [0082.201] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12fd0 | out: hHeap=0x840000) returned 1 [0082.201] GetProcessHeap () returned 0x840000 [0082.201] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8659d0 | out: hHeap=0x840000) returned 1 [0082.201] GetProcessHeap () returned 0x840000 [0082.201] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4000) returned 0x2b12fd0 [0082.201] GetProcessHeap () returned 0x840000 [0082.201] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8659d0 [0082.201] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x229f83c | out: lphEnum=0x229f83c*=0x8634d8) returned 0x0 [0096.366] WNetEnumResourceW (in: hEnum=0x8634d8, lpcCount=0x229f830, lpBuffer=0x2b12fd0, lpBufferSize=0x229f844 | out: lpcCount=0x229f830, lpBuffer=0x2b12fd0, lpBufferSize=0x229f844) returned 0x0 [0096.366] GetProcessHeap () returned 0x840000 [0096.366] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4000) returned 0x2b1cfd8 [0096.366] GetProcessHeap () returned 0x840000 [0096.366] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0096.367] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x2b12fd0, lphEnum=0x229f7f4) Thread: id = 9 os_tid = 0xaf8 [0079.282] GetLogicalDrives () returned 0x4 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x8553c0 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x879d60 [0079.282] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0079.282] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x130 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85df30 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85df58 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85df80 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a6e0 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a6e0 | out: hHeap=0x840000) returned 1 [0079.282] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85df58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85df80 | out: hHeap=0x840000) returned 1 [0079.282] GetProcessHeap () returned 0x840000 [0079.282] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85df30 | out: hHeap=0x840000) returned 1 [0079.282] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x236f81c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x236f81c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85df58 | out: hHeap=0x840000) returned 1 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a040 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a058 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a070 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a6e0 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a088 [0079.283] htonl (hostlong=0x9c354b42) returned 0x424b359c [0079.283] QueryPerformanceCounter (in: lpPerformanceCount=0x236f718 | out: lpPerformanceCount=0x236f718*=19943399603) returned 1 [0079.283] GetTickCount () returned 0x114ed9a [0079.283] GetCurrentProcessId () returned 0xa28 [0079.283] GetCurrentThreadId () returned 0xaf8 [0079.283] GetLocalTime (in: lpSystemTime=0x236f700 | out: lpSystemTime=0x236f700*(wYear=0x7e3, wMonth=0xa, wDayOfWeek=0x0, wDay=0xd, wHour=0x17, wMinute=0x38, wSecond=0x1a, wMilliseconds=0x3db)) [0079.283] SystemTimeToFileTime (in: lpSystemTime=0x236f700, lpFileTime=0x236f710 | out: lpFileTime=0x236f710) returned 1 [0079.283] QueryPerformanceCounter (in: lpPerformanceCount=0x236f718 | out: lpPerformanceCount=0x236f718*=19943425041) returned 1 [0079.283] GetProcessHeap () returned 0x840000 [0079.283] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x28) returned 0x879d90 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0a0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861ac0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x14) returned 0x862020 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0b8 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x80) returned 0x87c6c8 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0d0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x82) returned 0x87c750 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0e8 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861ae0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a100 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x80) returned 0x87c7e0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a118 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x2) returned 0x861af0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861b00 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a130 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x80) returned 0x87c868 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a148 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861b10 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x861af0, Size=0x82) returned 0x87c8f0 [0079.284] GetProcessHeap () returned 0x840000 [0079.284] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x861b10, Size=0x100) returned 0x87c980 [0079.284] GetProcessHeap () returned 0x840000 [0079.285] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a160 [0079.285] GetProcessHeap () returned 0x840000 [0079.285] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x82) returned 0x87ca88 [0079.285] GetProcessHeap () returned 0x840000 [0079.285] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a178 [0079.285] GetProcessHeap () returned 0x840000 [0079.285] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x82) returned 0x87cb18 [0079.285] GetProcessHeap () returned 0x840000 [0079.285] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x87c8f0, Size=0x104) returned 0x87cba8 [0079.285] GetProcessHeap () returned 0x840000 [0079.285] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x87c980, Size=0x200) returned 0x87ccb8 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x861b00 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87ccb8 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a148 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87c7e0 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a100 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87c868 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a130 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87cba8 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a118 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87ca88 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a160 | out: hHeap=0x840000) returned 1 [0079.286] GetProcessHeap () returned 0x840000 [0079.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87cb18 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a178 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x861ac0 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0a0 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87c750 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0d0 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87c6c8 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0b8 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x861ae0 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0e8 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x879d90 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x862020 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xa4) returned 0x87c6c8 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a058 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a070 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a6e0 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a088 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a040 | out: hHeap=0x840000) returned 1 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x14) returned 0x862020 [0079.287] GetProcessHeap () returned 0x840000 [0079.287] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe) returned 0x87a040 [0079.287] ResetEvent (hEvent=0x130) returned 1 [0079.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404a4c, lpParameter=0x862020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0079.289] CloseHandle (hObject=0x134) returned 1 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a088 [0079.289] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a070 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a058 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a6e0 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0e8 [0079.290] htonl (hostlong=0x9c354b42) returned 0x424b359c [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x28) returned 0x87c988 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0b8 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861ae0 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x14) returned 0x862060 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0d0 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x80) returned 0x87c9b8 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a0a0 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x82) returned 0x87ca40 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a178 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861ac0 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a160 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x80) returned 0x87cad0 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a118 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x2) returned 0x861b00 [0079.290] GetProcessHeap () returned 0x840000 [0079.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861b10 [0079.290] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a130 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x80) returned 0x87cb58 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a100 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x4) returned 0x861af0 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x861b00, Size=0x82) returned 0x87cbe0 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x861af0, Size=0x100) returned 0x87cc70 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a148 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x82) returned 0x87cd78 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10) returned 0x87a190 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x82) returned 0x87ce08 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x87cbe0, Size=0x104) returned 0x87ce98 [0079.291] GetProcessHeap () returned 0x840000 [0079.291] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x87cc70, Size=0x200) returned 0x87cfa8 [0079.293] GetProcessHeap () returned 0x840000 [0079.293] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x861b10 | out: hHeap=0x840000) returned 1 [0079.293] GetProcessHeap () returned 0x840000 [0079.293] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87cfa8 | out: hHeap=0x840000) returned 1 [0079.293] GetProcessHeap () returned 0x840000 [0079.293] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a100 | out: hHeap=0x840000) returned 1 [0079.293] GetProcessHeap () returned 0x840000 [0079.293] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87cad0 | out: hHeap=0x840000) returned 1 [0079.293] GetProcessHeap () returned 0x840000 [0079.293] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a160 | out: hHeap=0x840000) returned 1 [0079.293] GetProcessHeap () returned 0x840000 [0079.293] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87cb58 | out: hHeap=0x840000) returned 1 [0079.293] GetProcessHeap () returned 0x840000 [0079.294] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a130 | out: hHeap=0x840000) returned 1 [0079.294] GetProcessHeap () returned 0x840000 [0079.294] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87ce98 | out: hHeap=0x840000) returned 1 [0079.294] GetProcessHeap () returned 0x840000 [0079.294] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a118 | out: hHeap=0x840000) returned 1 [0079.294] GetProcessHeap () returned 0x840000 [0079.294] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87cd78 | out: hHeap=0x840000) returned 1 [0079.294] GetProcessHeap () returned 0x840000 [0079.294] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a148 | out: hHeap=0x840000) returned 1 [0079.294] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87ce08 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a190 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x861ae0 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0b8 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87ca40 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0a0 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87c9b8 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0d0 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x861ac0 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a178 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87c988 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x862060 | out: hHeap=0x840000) returned 1 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0xa4) returned 0x87c988 [0079.295] GetProcessHeap () returned 0x840000 [0079.295] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a070 | out: hHeap=0x840000) returned 1 [0079.296] GetProcessHeap () returned 0x840000 [0079.296] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a058 | out: hHeap=0x840000) returned 1 [0079.296] GetProcessHeap () returned 0x840000 [0079.296] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a6e0 | out: hHeap=0x840000) returned 1 [0079.296] GetProcessHeap () returned 0x840000 [0079.296] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a0e8 | out: hHeap=0x840000) returned 1 [0079.296] GetProcessHeap () returned 0x840000 [0079.296] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a088 | out: hHeap=0x840000) returned 1 [0079.296] GetProcessHeap () returned 0x840000 [0079.296] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x14) returned 0x862060 [0079.296] GetProcessHeap () returned 0x840000 [0079.296] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe) returned 0x87a088 [0079.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404a4c, lpParameter=0x862060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0079.297] CloseHandle (hObject=0x134) returned 1 [0079.298] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) Thread: id = 10 os_tid = 0xafc [0079.288] GetLogicalDrives () returned 0x4 [0079.288] GetProcessHeap () returned 0x840000 [0079.288] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20) returned 0x85df30 [0079.288] GetProcessHeap () returned 0x840000 [0079.288] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1e) returned 0x85df80 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x1e) returned 0x85dfa8 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x90) returned 0x87a6e0 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x87a6e0 | out: hHeap=0x840000) returned 1 [0079.289] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x85df80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85dfa8 | out: hHeap=0x840000) returned 1 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85df30 | out: hHeap=0x840000) returned 1 [0079.289] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcbfe9c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcbfe9c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85df80 | out: hHeap=0x840000) returned 1 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x40) returned 0x855408 [0079.289] GetProcessHeap () returned 0x840000 [0079.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x879d90 [0079.289] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x138 [0079.289] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0079.289] GetLogicalDrives () returned 0x4 [0079.289] Sleep (dwMilliseconds=0x3e8) [0080.590] GetLogicalDrives () returned 0x4 [0080.590] Sleep (dwMilliseconds=0x3e8) [0081.729] GetLogicalDrives () returned 0x4 [0081.729] Sleep (dwMilliseconds=0x3e8) [0082.868] GetLogicalDrives () returned 0x4 [0082.868] Sleep (dwMilliseconds=0x3e8) [0084.025] GetLogicalDrives () returned 0x4 [0084.026] Sleep (dwMilliseconds=0x3e8) [0085.192] GetLogicalDrives () returned 0x4 [0085.192] Sleep (dwMilliseconds=0x3e8) [0086.315] GetLogicalDrives () returned 0x4 [0086.315] Sleep (dwMilliseconds=0x3e8) [0087.560] GetLogicalDrives () returned 0x4 [0087.560] Sleep (dwMilliseconds=0x3e8) [0088.626] GetLogicalDrives () returned 0x4 [0088.626] Sleep (dwMilliseconds=0x3e8) [0089.745] GetLogicalDrives () returned 0x4 [0089.745] Sleep (dwMilliseconds=0x3e8) [0090.771] GetLogicalDrives () returned 0x4 [0090.771] Sleep (dwMilliseconds=0x3e8) [0091.831] GetLogicalDrives () returned 0x4 [0091.831] Sleep (dwMilliseconds=0x3e8) [0092.916] GetLogicalDrives () returned 0x4 [0092.916] Sleep (dwMilliseconds=0x3e8) [0094.006] GetLogicalDrives () returned 0x4 [0094.006] Sleep (dwMilliseconds=0x3e8) [0095.026] GetLogicalDrives () returned 0x4 [0095.026] Sleep (dwMilliseconds=0x3e8) [0096.038] GetLogicalDrives () returned 0x4 [0096.038] Sleep (dwMilliseconds=0x3e8) [0097.099] GetLogicalDrives () returned 0x4 [0097.099] Sleep (dwMilliseconds=0x3e8) [0098.236] GetLogicalDrives () returned 0x4 [0098.236] Sleep (dwMilliseconds=0x3e8) [0099.278] GetLogicalDrives () returned 0x4 [0099.278] Sleep (dwMilliseconds=0x3e8) [0100.374] GetLogicalDrives () returned 0x4 [0100.374] Sleep (dwMilliseconds=0x3e8) [0101.658] GetLogicalDrives () returned 0x4 [0101.659] Sleep (dwMilliseconds=0x3e8) Thread: id = 11 os_tid = 0xb00 [0079.393] GetProcessHeap () returned 0x840000 [0079.393] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x38) returned 0x87dc60 [0079.393] GetProcessHeap () returned 0x840000 [0079.393] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x18) returned 0x8620a0 [0079.393] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x144 [0079.393] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0079.393] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x14c [0079.393] GetProcessHeap () returned 0x840000 [0079.393] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x87dca0 [0079.394] GetProcessHeap () returned 0x840000 [0079.394] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0079.394] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0079.394] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0079.394] Wow64DisableWow64FsRedirection (in: OldValue=0x27bfb8c | out: OldValue=0x27bfb8c*=0x0) returned 1 [0079.394] GetProcessHeap () returned 0x840000 [0079.394] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0079.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x27bfb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0079.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x27bfb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164 [0079.398] GetProcessHeap () returned 0x840000 [0079.398] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x89df00 [0079.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8adf08 [0079.399] GetProcessHeap () returned 0x840000 [0079.399] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8adf48 [0079.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8bdf50 [0079.399] FindNextFileW (in: hFindFile=0x8bdf50, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x8bdf50, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0079.399] GetProcessHeap () returned 0x840000 [0079.399] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bef98 [0079.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8cefa0 [0079.400] FindNextFileW (in: hFindFile=0x8cefa0, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.400] FindNextFileW (in: hFindFile=0x8cefa0, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.400] SetEvent (hEvent=0x148) returned 1 [0079.400] ResetEvent (hEvent=0x14c) returned 1 [0079.400] FindNextFileW (in: hFindFile=0x8cefa0, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0079.400] FindClose (in: hFindFile=0x8cefa0 | out: hFindFile=0x8cefa0) returned 1 [0079.400] GetProcessHeap () returned 0x840000 [0079.400] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bef98 | out: hHeap=0x840000) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8bdf50, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0079.401] FindClose (in: hFindFile=0x8bdf50 | out: hFindFile=0x8bdf50) returned 1 [0079.401] GetProcessHeap () returned 0x840000 [0079.401] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8adf48 | out: hHeap=0x840000) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0079.401] GetProcessHeap () returned 0x840000 [0079.401] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8aef50 [0079.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8bef58 [0079.401] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0079.401] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0079.402] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0079.402] GetProcessHeap () returned 0x840000 [0079.402] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900060 [0079.432] FindNextFileW (in: hFindFile=0x900060, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x900060, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x900060, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.440] FindClose (in: hFindFile=0x900060 | out: hFindFile=0x900060) returned 1 [0079.441] GetProcessHeap () returned 0x840000 [0079.442] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.445] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0079.445] GetProcessHeap () returned 0x840000 [0079.447] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.448] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.448] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.448] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.448] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.448] GetProcessHeap () returned 0x840000 [0079.448] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.448] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0079.448] GetProcessHeap () returned 0x840000 [0079.448] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.448] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.448] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.449] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.449] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.449] GetProcessHeap () returned 0x840000 [0079.449] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.449] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0079.449] GetProcessHeap () returned 0x840000 [0079.449] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.449] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.449] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.449] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.449] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.449] GetProcessHeap () returned 0x840000 [0079.449] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.449] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.449] GetProcessHeap () returned 0x840000 [0079.449] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.449] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.450] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.450] GetProcessHeap () returned 0x840000 [0079.450] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0079.450] GetProcessHeap () returned 0x840000 [0079.450] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.450] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.450] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.450] GetProcessHeap () returned 0x840000 [0079.450] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.450] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0079.451] GetProcessHeap () returned 0x840000 [0079.451] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.451] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.451] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.451] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.451] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.451] GetProcessHeap () returned 0x840000 [0079.451] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.451] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0079.451] GetProcessHeap () returned 0x840000 [0079.451] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.451] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.451] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0079.452] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.452] GetProcessHeap () returned 0x840000 [0079.452] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0079.452] GetProcessHeap () returned 0x840000 [0079.452] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.452] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.453] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.453] GetProcessHeap () returned 0x840000 [0079.453] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.453] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0079.453] GetProcessHeap () returned 0x840000 [0079.453] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.453] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.453] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.453] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.453] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.453] GetProcessHeap () returned 0x840000 [0079.453] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.453] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0079.453] GetProcessHeap () returned 0x840000 [0079.453] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.453] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.453] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.454] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.454] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.454] GetProcessHeap () returned 0x840000 [0079.454] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.454] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0079.454] GetProcessHeap () returned 0x840000 [0079.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.454] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.454] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.454] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.454] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.454] GetProcessHeap () returned 0x840000 [0079.454] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.454] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0079.454] GetProcessHeap () returned 0x840000 [0079.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.454] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.454] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.455] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.455] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.455] GetProcessHeap () returned 0x840000 [0079.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.455] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0079.455] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0079.455] GetProcessHeap () returned 0x840000 [0079.455] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.455] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.455] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.455] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.455] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.455] GetProcessHeap () returned 0x840000 [0079.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.455] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0079.455] GetProcessHeap () returned 0x840000 [0079.455] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.456] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.456] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.456] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.456] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.456] GetProcessHeap () returned 0x840000 [0079.456] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.456] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0079.456] GetProcessHeap () returned 0x840000 [0079.456] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.456] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.456] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.456] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.456] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.456] GetProcessHeap () returned 0x840000 [0079.456] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.456] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0079.456] GetProcessHeap () returned 0x840000 [0079.456] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.457] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.457] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.457] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.457] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.457] GetProcessHeap () returned 0x840000 [0079.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.457] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0079.457] GetProcessHeap () returned 0x840000 [0079.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.457] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.457] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.457] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.457] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.457] GetProcessHeap () returned 0x840000 [0079.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.457] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0079.457] GetProcessHeap () returned 0x840000 [0079.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.458] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.458] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.458] GetProcessHeap () returned 0x840000 [0079.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0079.458] GetProcessHeap () returned 0x840000 [0079.458] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.458] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.458] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.458] GetProcessHeap () returned 0x840000 [0079.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0079.459] GetProcessHeap () returned 0x840000 [0079.459] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.459] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.459] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.459] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.459] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.459] GetProcessHeap () returned 0x840000 [0079.459] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.459] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0079.459] GetProcessHeap () returned 0x840000 [0079.459] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.459] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.459] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.459] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.459] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.459] GetProcessHeap () returned 0x840000 [0079.459] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.459] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0079.460] GetProcessHeap () returned 0x840000 [0079.460] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.460] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.460] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.460] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.460] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.460] GetProcessHeap () returned 0x840000 [0079.460] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.460] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0079.460] GetProcessHeap () returned 0x840000 [0079.460] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.460] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.460] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.460] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.460] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.460] GetProcessHeap () returned 0x840000 [0079.460] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.460] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0079.460] FindClose (in: hFindFile=0x8bef58 | out: hFindFile=0x8bef58) returned 1 [0079.461] GetProcessHeap () returned 0x840000 [0079.461] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8aef50 | out: hHeap=0x840000) returned 1 [0079.461] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0079.461] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0079.461] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0079.461] GetProcessHeap () returned 0x840000 [0079.461] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8aef50 [0079.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8bef58 [0079.462] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.462] FindClose (in: hFindFile=0x8bef58 | out: hFindFile=0x8bef58) returned 1 [0079.462] GetProcessHeap () returned 0x840000 [0079.462] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8aef50 | out: hHeap=0x840000) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0079.462] FindNextFileW (in: hFindFile=0x8adf08, lpFindFileData=0x27bf900 | out: lpFindFileData=0x27bf900*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0079.462] GetProcessHeap () returned 0x840000 [0079.462] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8aef50 [0079.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8bef58 [0079.463] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.463] FindNextFileW (in: hFindFile=0x8bef58, lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0079.463] GetProcessHeap () returned 0x840000 [0079.463] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.464] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.465] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0079.465] GetProcessHeap () returned 0x840000 [0079.465] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900298 [0079.465] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.465] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0079.465] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0079.465] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0079.466] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.466] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.466] FindClose (in: hFindFile=0x900298 | out: hFindFile=0x900298) returned 1 [0079.466] GetProcessHeap () returned 0x840000 [0079.466] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.466] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0079.466] GetProcessHeap () returned 0x840000 [0079.466] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900298 [0079.467] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.467] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0079.467] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0079.467] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0079.467] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.467] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.467] FindClose (in: hFindFile=0x900298 | out: hFindFile=0x900298) returned 1 [0079.468] GetProcessHeap () returned 0x840000 [0079.468] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.468] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0079.468] GetProcessHeap () returned 0x840000 [0079.468] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900298 [0079.469] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.469] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0079.470] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0079.470] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0079.470] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.470] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.470] FindClose (in: hFindFile=0x900298 | out: hFindFile=0x900298) returned 1 [0079.470] GetProcessHeap () returned 0x840000 [0079.470] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.470] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0079.470] GetProcessHeap () returned 0x840000 [0079.470] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9002d8 [0079.474] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.474] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0079.474] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0079.474] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0079.474] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.475] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.475] FindClose (in: hFindFile=0x9002d8 | out: hFindFile=0x9002d8) returned 1 [0079.475] GetProcessHeap () returned 0x840000 [0079.475] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.475] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0079.475] GetProcessHeap () returned 0x840000 [0079.475] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9002d8 [0079.476] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.476] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.476] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0079.477] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0079.477] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0079.477] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0079.477] FindClose (in: hFindFile=0x9002d8 | out: hFindFile=0x9002d8) returned 1 [0079.477] GetProcessHeap () returned 0x840000 [0079.477] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.477] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0079.477] GetProcessHeap () returned 0x840000 [0079.477] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9002d8 [0079.479] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.479] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0079.479] GetProcessHeap () returned 0x840000 [0079.479] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x927978 [0079.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900318 [0079.480] FindNextFileW (in: hFindFile=0x900318, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x900318, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x900318, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x900318, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x900318, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0079.480] FindClose (in: hFindFile=0x900318 | out: hFindFile=0x900318) returned 1 [0079.480] GetProcessHeap () returned 0x840000 [0079.480] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x927978 | out: hHeap=0x840000) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0079.480] GetProcessHeap () returned 0x840000 [0079.480] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x927978 [0079.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.481] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.482] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0079.482] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0079.482] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0079.482] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0079.482] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.482] GetProcessHeap () returned 0x840000 [0079.482] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x927978 | out: hHeap=0x840000) returned 1 [0079.482] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0079.482] GetProcessHeap () returned 0x840000 [0079.482] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x927978 [0079.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.483] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0079.483] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.483] GetProcessHeap () returned 0x840000 [0079.483] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x927978 | out: hHeap=0x840000) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x9002d8, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.483] FindClose (in: hFindFile=0x9002d8 | out: hFindFile=0x9002d8) returned 1 [0079.483] GetProcessHeap () returned 0x840000 [0079.483] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.484] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0079.484] GetProcessHeap () returned 0x840000 [0079.484] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.486] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.487] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.487] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.487] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0079.487] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.487] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.487] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.488] GetProcessHeap () returned 0x840000 [0079.488] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.488] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0079.488] GetProcessHeap () returned 0x840000 [0079.488] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.503] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.504] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0079.507] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0079.510] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0079.519] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.520] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.522] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.526] GetProcessHeap () returned 0x840000 [0079.526] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0079.527] GetProcessHeap () returned 0x840000 [0079.527] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.527] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0079.527] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.527] GetProcessHeap () returned 0x840000 [0079.527] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.527] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0079.528] GetProcessHeap () returned 0x840000 [0079.528] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.528] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.528] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0079.528] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.529] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.529] GetProcessHeap () returned 0x840000 [0079.529] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.530] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0079.530] GetProcessHeap () returned 0x840000 [0079.530] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.530] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.530] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0079.530] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.531] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.531] GetProcessHeap () returned 0x840000 [0079.532] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.532] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0079.532] GetProcessHeap () returned 0x840000 [0079.532] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.532] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.532] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0079.533] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0079.533] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0079.533] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.533] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.533] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.534] GetProcessHeap () returned 0x840000 [0079.534] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.534] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0079.534] GetProcessHeap () returned 0x840000 [0079.534] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.534] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.534] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0079.534] GetProcessHeap () returned 0x840000 [0079.534] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.534] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.534] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0079.534] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0079.534] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.534] GetProcessHeap () returned 0x840000 [0079.534] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.534] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0079.534] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0079.535] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.536] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.536] GetProcessHeap () returned 0x840000 [0079.536] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.536] GetProcessHeap () returned 0x840000 [0079.536] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.536] GetProcessHeap () returned 0x840000 [0079.536] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.537] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.538] GetProcessHeap () returned 0x840000 [0079.538] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.538] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.538] GetProcessHeap () returned 0x840000 [0079.538] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.538] GetProcessHeap () returned 0x840000 [0079.538] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.541] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.541] GetProcessHeap () returned 0x840000 [0079.541] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.541] GetProcessHeap () returned 0x840000 [0079.541] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.543] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.544] GetProcessHeap () returned 0x840000 [0079.544] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.544] GetProcessHeap () returned 0x840000 [0079.544] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x915960 [0079.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.546] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.547] GetProcessHeap () returned 0x840000 [0079.547] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x915960 | out: hHeap=0x840000) returned 1 [0079.547] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.547] GetProcessHeap () returned 0x840000 [0079.547] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.547] FindClose (in: hFindFile=0x8bef58 | out: hFindFile=0x8bef58) returned 1 [0079.547] GetProcessHeap () returned 0x840000 [0079.547] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8aef50 | out: hHeap=0x840000) returned 1 [0079.548] GetProcessHeap () returned 0x840000 [0079.548] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8aef50 [0079.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.549] GetProcessHeap () returned 0x840000 [0079.549] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a18 [0079.549] FindClose (in: hFindFile=0x937a18 | out: hFindFile=0x937a18) returned 1 [0079.549] GetProcessHeap () returned 0x840000 [0079.549] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.550] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.550] GetProcessHeap () returned 0x840000 [0079.550] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8aef50 | out: hHeap=0x840000) returned 1 [0079.550] GetProcessHeap () returned 0x840000 [0079.550] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8aef50 [0079.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x27bf670 | out: lpFindFileData=0x27bf670*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79ed58e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x79ed58e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.551] GetProcessHeap () returned 0x840000 [0079.551] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x27bf3e0 | out: lpFindFileData=0x27bf3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x768d45c0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768d45c0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a18 [0079.552] GetProcessHeap () returned 0x840000 [0079.552] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x914958 [0079.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a58 [0079.552] FindClose (in: hFindFile=0x937a58 | out: hFindFile=0x937a58) returned 1 [0079.552] GetProcessHeap () returned 0x840000 [0079.552] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x914958 | out: hHeap=0x840000) returned 1 [0079.552] GetProcessHeap () returned 0x840000 [0079.552] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x914958 [0079.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a58 [0079.552] GetProcessHeap () returned 0x840000 [0079.553] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0079.554] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0079.554] GetProcessHeap () returned 0x840000 [0079.554] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.554] GetProcessHeap () returned 0x840000 [0079.554] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0079.555] GetProcessHeap () returned 0x840000 [0079.555] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0079.556] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0079.556] GetProcessHeap () returned 0x840000 [0079.556] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.556] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0079.556] GetProcessHeap () returned 0x840000 [0079.556] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.557] GetProcessHeap () returned 0x840000 [0079.557] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0079.558] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0079.558] GetProcessHeap () returned 0x840000 [0079.558] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.558] GetProcessHeap () returned 0x840000 [0079.558] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0079.559] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0079.560] GetProcessHeap () returned 0x840000 [0079.560] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.560] GetProcessHeap () returned 0x840000 [0079.560] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.642] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.644] GetProcessHeap () returned 0x840000 [0079.644] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.644] GetProcessHeap () returned 0x840000 [0079.644] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.644] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.644] GetProcessHeap () returned 0x840000 [0079.644] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.644] GetProcessHeap () returned 0x840000 [0079.644] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.644] GetProcessHeap () returned 0x840000 [0079.644] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.646] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.646] GetProcessHeap () returned 0x840000 [0079.646] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.646] GetProcessHeap () returned 0x840000 [0079.646] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.646] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.646] GetProcessHeap () returned 0x840000 [0079.646] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.646] GetProcessHeap () returned 0x840000 [0079.646] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.647] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.647] GetProcessHeap () returned 0x840000 [0079.647] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.647] GetProcessHeap () returned 0x840000 [0079.647] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.647] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.647] GetProcessHeap () returned 0x840000 [0079.647] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.647] GetProcessHeap () returned 0x840000 [0079.647] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.649] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.649] GetProcessHeap () returned 0x840000 [0079.649] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.649] GetProcessHeap () returned 0x840000 [0079.649] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.649] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.649] GetProcessHeap () returned 0x840000 [0079.649] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.649] GetProcessHeap () returned 0x840000 [0079.649] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.651] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.652] GetProcessHeap () returned 0x840000 [0079.652] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.652] GetProcessHeap () returned 0x840000 [0079.652] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.653] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.653] GetProcessHeap () returned 0x840000 [0079.653] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.653] GetProcessHeap () returned 0x840000 [0079.653] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.655] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.655] GetProcessHeap () returned 0x840000 [0079.655] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.655] GetProcessHeap () returned 0x840000 [0079.655] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.655] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.655] GetProcessHeap () returned 0x840000 [0079.655] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.655] GetProcessHeap () returned 0x840000 [0079.655] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.656] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.656] GetProcessHeap () returned 0x840000 [0079.656] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.656] GetProcessHeap () returned 0x840000 [0079.656] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.658] GetProcessHeap () returned 0x840000 [0079.658] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.660] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.660] GetProcessHeap () returned 0x840000 [0079.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.660] GetProcessHeap () returned 0x840000 [0079.660] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.660] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.660] GetProcessHeap () returned 0x840000 [0079.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.660] GetProcessHeap () returned 0x840000 [0079.660] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.662] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.663] GetProcessHeap () returned 0x840000 [0079.663] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.663] GetProcessHeap () returned 0x840000 [0079.663] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.663] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.664] GetProcessHeap () returned 0x840000 [0079.664] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.664] GetProcessHeap () returned 0x840000 [0079.664] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.667] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.668] GetProcessHeap () returned 0x840000 [0079.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.668] GetProcessHeap () returned 0x840000 [0079.668] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.668] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.668] GetProcessHeap () returned 0x840000 [0079.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.668] GetProcessHeap () returned 0x840000 [0079.668] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.668] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.668] GetProcessHeap () returned 0x840000 [0079.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.668] GetProcessHeap () returned 0x840000 [0079.668] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.669] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.669] GetProcessHeap () returned 0x840000 [0079.669] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.669] GetProcessHeap () returned 0x840000 [0079.669] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.700] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.701] GetProcessHeap () returned 0x840000 [0079.701] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.701] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.701] GetProcessHeap () returned 0x840000 [0079.701] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.701] GetProcessHeap () returned 0x840000 [0079.701] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.701] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.701] GetProcessHeap () returned 0x840000 [0079.701] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.701] GetProcessHeap () returned 0x840000 [0079.701] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.702] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.702] GetProcessHeap () returned 0x840000 [0079.702] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.702] GetProcessHeap () returned 0x840000 [0079.702] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.702] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.702] GetProcessHeap () returned 0x840000 [0079.702] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.702] GetProcessHeap () returned 0x840000 [0079.702] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.703] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.703] GetProcessHeap () returned 0x840000 [0079.703] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.704] GetProcessHeap () returned 0x840000 [0079.704] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.704] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.704] GetProcessHeap () returned 0x840000 [0079.704] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.704] GetProcessHeap () returned 0x840000 [0079.704] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.705] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.705] GetProcessHeap () returned 0x840000 [0079.705] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.705] GetProcessHeap () returned 0x840000 [0079.705] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.705] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.705] GetProcessHeap () returned 0x840000 [0079.705] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.705] GetProcessHeap () returned 0x840000 [0079.705] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.706] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.706] GetProcessHeap () returned 0x840000 [0079.706] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.706] GetProcessHeap () returned 0x840000 [0079.706] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.707] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.707] GetProcessHeap () returned 0x840000 [0079.707] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.707] GetProcessHeap () returned 0x840000 [0079.707] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.707] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.707] GetProcessHeap () returned 0x840000 [0079.707] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.707] GetProcessHeap () returned 0x840000 [0079.707] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.708] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.708] GetProcessHeap () returned 0x840000 [0079.708] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.708] GetProcessHeap () returned 0x840000 [0079.708] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.709] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.709] GetProcessHeap () returned 0x840000 [0079.709] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.709] GetProcessHeap () returned 0x840000 [0079.709] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.709] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.709] GetProcessHeap () returned 0x840000 [0079.709] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.709] GetProcessHeap () returned 0x840000 [0079.709] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.710] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.710] GetProcessHeap () returned 0x840000 [0079.710] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.710] GetProcessHeap () returned 0x840000 [0079.710] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.710] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.710] GetProcessHeap () returned 0x840000 [0079.710] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.710] GetProcessHeap () returned 0x840000 [0079.710] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.711] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.711] GetProcessHeap () returned 0x840000 [0079.711] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.711] GetProcessHeap () returned 0x840000 [0079.711] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.712] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.712] GetProcessHeap () returned 0x840000 [0079.712] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.712] GetProcessHeap () returned 0x840000 [0079.712] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.712] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.712] GetProcessHeap () returned 0x840000 [0079.712] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.712] GetProcessHeap () returned 0x840000 [0079.712] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.713] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.713] GetProcessHeap () returned 0x840000 [0079.713] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.713] GetProcessHeap () returned 0x840000 [0079.713] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.714] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.714] GetProcessHeap () returned 0x840000 [0079.714] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.714] GetProcessHeap () returned 0x840000 [0079.714] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.714] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.714] GetProcessHeap () returned 0x840000 [0079.714] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.714] GetProcessHeap () returned 0x840000 [0079.714] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.715] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.715] GetProcessHeap () returned 0x840000 [0079.715] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.715] GetProcessHeap () returned 0x840000 [0079.715] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.715] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.715] GetProcessHeap () returned 0x840000 [0079.715] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.715] GetProcessHeap () returned 0x840000 [0079.715] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.799] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.799] GetProcessHeap () returned 0x840000 [0079.799] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.799] GetProcessHeap () returned 0x840000 [0079.799] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.799] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.799] GetProcessHeap () returned 0x840000 [0079.799] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.800] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.800] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.800] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.800] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.800] GetProcessHeap () returned 0x840000 [0079.800] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0079.801] GetProcessHeap () returned 0x840000 [0079.801] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0079.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.801] GetProcessHeap () returned 0x840000 [0079.801] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.802] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.802] GetProcessHeap () returned 0x840000 [0079.802] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.802] GetProcessHeap () returned 0x840000 [0079.802] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.803] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.803] GetProcessHeap () returned 0x840000 [0079.803] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.803] GetProcessHeap () returned 0x840000 [0079.803] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.804] GetProcessHeap () returned 0x840000 [0079.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0079.805] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0079.806] GetProcessHeap () returned 0x840000 [0079.806] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.806] GetProcessHeap () returned 0x840000 [0079.806] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0079.806] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0079.806] GetProcessHeap () returned 0x840000 [0079.806] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.806] GetProcessHeap () returned 0x840000 [0079.806] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.809] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.809] GetProcessHeap () returned 0x840000 [0079.810] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.810] GetProcessHeap () returned 0x840000 [0079.810] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.810] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.811] GetProcessHeap () returned 0x840000 [0079.811] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.811] GetProcessHeap () returned 0x840000 [0079.811] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.812] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.813] GetProcessHeap () returned 0x840000 [0079.813] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.813] GetProcessHeap () returned 0x840000 [0079.813] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.814] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.814] GetProcessHeap () returned 0x840000 [0079.814] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.815] GetProcessHeap () returned 0x840000 [0079.815] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11070 [0079.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0079.815] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0079.815] GetProcessHeap () returned 0x840000 [0079.815] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11070 | out: hHeap=0x840000) returned 1 [0079.815] GetProcessHeap () returned 0x840000 [0079.816] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0079.816] ResetEvent (hEvent=0x144) returned 1 [0079.816] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0079.873] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0079.873] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0079.873] GetProcessHeap () returned 0x840000 [0079.873] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.873] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0079.873] ResetEvent (hEvent=0x144) returned 1 [0079.873] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0079.936] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0079.936] ResetEvent (hEvent=0x144) returned 1 [0079.937] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0079.953] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0079.953] GetProcessHeap () returned 0x840000 [0079.953] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0079.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0080.030] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.030] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0080.030] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.030] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.030] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0080.030] GetProcessHeap () returned 0x840000 [0080.030] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0080.030] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0080.030] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0080.031] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0080.031] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0080.031] GetProcessHeap () returned 0x840000 [0080.031] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0080.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0080.032] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.032] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0080.032] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.032] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.032] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0080.032] GetProcessHeap () returned 0x840000 [0080.032] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0080.032] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0080.032] GetProcessHeap () returned 0x840000 [0080.032] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0080.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0080.033] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.033] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0080.033] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.033] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.033] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0080.033] GetProcessHeap () returned 0x840000 [0080.033] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0080.034] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0080.034] GetProcessHeap () returned 0x840000 [0080.034] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0080.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0080.034] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.034] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0080.034] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.035] ResetEvent (hEvent=0x144) returned 1 [0080.035] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0080.750] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.750] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0080.750] GetProcessHeap () returned 0x840000 [0080.750] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0080.750] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0080.750] GetProcessHeap () returned 0x840000 [0080.750] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0080.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0080.750] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.751] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0080.751] ResetEvent (hEvent=0x144) returned 1 [0080.751] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0082.371] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0082.371] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0082.371] GetProcessHeap () returned 0x840000 [0082.371] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0082.371] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0082.371] GetProcessHeap () returned 0x840000 [0082.371] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0082.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0082.371] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.371] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0082.371] ResetEvent (hEvent=0x144) returned 1 [0082.371] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0082.384] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0082.384] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0082.384] GetProcessHeap () returned 0x840000 [0082.384] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0082.385] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0082.385] GetProcessHeap () returned 0x840000 [0082.385] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0082.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0082.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0082.385] ResetEvent (hEvent=0x144) returned 1 [0082.385] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0082.404] ResetEvent (hEvent=0x144) returned 1 [0082.404] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0082.626] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0082.626] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0082.626] GetProcessHeap () returned 0x840000 [0082.626] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0082.626] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0082.626] GetProcessHeap () returned 0x840000 [0082.626] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0082.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0082.626] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.626] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0082.627] ResetEvent (hEvent=0x144) returned 1 [0082.627] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0083.262] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0083.262] ResetEvent (hEvent=0x144) returned 1 [0083.262] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0083.842] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0083.842] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0083.842] GetProcessHeap () returned 0x840000 [0083.842] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0083.842] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0083.842] GetProcessHeap () returned 0x840000 [0083.842] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0083.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0083.842] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.842] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0083.843] ResetEvent (hEvent=0x144) returned 1 [0083.843] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0083.854] ResetEvent (hEvent=0x144) returned 1 [0083.854] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.210] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0085.210] ResetEvent (hEvent=0x144) returned 1 [0085.210] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.398] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0085.399] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0085.399] GetProcessHeap () returned 0x840000 [0085.399] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0085.399] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0085.399] GetProcessHeap () returned 0x840000 [0085.399] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0085.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0085.399] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.399] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0085.399] ResetEvent (hEvent=0x144) returned 1 [0085.399] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.927] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0085.928] ResetEvent (hEvent=0x144) returned 1 [0085.928] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.946] ResetEvent (hEvent=0x144) returned 1 [0085.946] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0087.735] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0087.735] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.735] GetProcessHeap () returned 0x840000 [0087.735] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.735] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0087.736] ResetEvent (hEvent=0x144) returned 1 [0087.736] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0087.934] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0087.934] GetProcessHeap () returned 0x840000 [0087.934] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.934] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.934] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0087.934] ResetEvent (hEvent=0x144) returned 1 [0087.934] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0087.956] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0087.956] ResetEvent (hEvent=0x144) returned 1 [0087.956] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0087.966] ResetEvent (hEvent=0x144) returned 1 [0087.966] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0087.979] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0087.979] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.979] GetProcessHeap () returned 0x840000 [0087.979] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.979] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0087.979] GetProcessHeap () returned 0x840000 [0087.979] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.980] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.980] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0087.980] ResetEvent (hEvent=0x144) returned 1 [0087.980] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0088.837] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0088.837] ResetEvent (hEvent=0x144) returned 1 [0088.837] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0089.617] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0089.617] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0089.617] GetProcessHeap () returned 0x840000 [0089.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0089.617] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0089.617] GetProcessHeap () returned 0x840000 [0089.617] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0089.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0089.617] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.617] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0089.617] ResetEvent (hEvent=0x144) returned 1 [0089.618] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0089.630] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0089.630] ResetEvent (hEvent=0x144) returned 1 [0089.630] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0090.262] ResetEvent (hEvent=0x144) returned 1 [0090.263] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0090.980] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0090.980] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0090.980] GetProcessHeap () returned 0x840000 [0090.980] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0090.980] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0090.980] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0090.980] GetProcessHeap () returned 0x840000 [0090.980] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0090.980] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0090.980] ResetEvent (hEvent=0x144) returned 1 [0090.980] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0091.114] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0091.114] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0091.114] ResetEvent (hEvent=0x144) returned 1 [0091.114] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0091.464] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0091.464] ResetEvent (hEvent=0x144) returned 1 [0091.464] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.011] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0092.011] ResetEvent (hEvent=0x144) returned 1 [0092.011] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.040] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0092.040] ResetEvent (hEvent=0x144) returned 1 [0092.040] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.461] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0092.461] ResetEvent (hEvent=0x144) returned 1 [0092.461] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.614] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0092.614] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0092.614] ResetEvent (hEvent=0x144) returned 1 [0092.614] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.659] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0092.662] ResetEvent (hEvent=0x144) returned 1 [0092.662] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.702] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0092.702] ResetEvent (hEvent=0x144) returned 1 [0092.702] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.717] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0092.717] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0092.717] GetProcessHeap () returned 0x840000 [0092.717] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0092.717] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0092.717] GetProcessHeap () returned 0x840000 [0092.717] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0092.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0092.718] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.718] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0092.718] ResetEvent (hEvent=0x144) returned 1 [0092.718] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.731] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0092.731] ResetEvent (hEvent=0x144) returned 1 [0092.731] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.800] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0092.801] ResetEvent (hEvent=0x144) returned 1 [0092.801] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.819] ResetEvent (hEvent=0x144) returned 1 [0092.819] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0092.989] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0092.989] ResetEvent (hEvent=0x144) returned 1 [0092.989] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.038] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0093.039] ResetEvent (hEvent=0x144) returned 1 [0093.039] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.211] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0093.211] ResetEvent (hEvent=0x144) returned 1 [0093.211] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.373] ResetEvent (hEvent=0x144) returned 1 [0093.374] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.412] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0093.412] ResetEvent (hEvent=0x144) returned 1 [0093.413] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.548] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0093.548] ResetEvent (hEvent=0x144) returned 1 [0093.548] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.570] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0093.570] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0093.571] GetProcessHeap () returned 0x840000 [0093.571] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0093.571] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0093.571] GetProcessHeap () returned 0x840000 [0093.571] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0093.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0093.572] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.572] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0093.572] ResetEvent (hEvent=0x144) returned 1 [0093.572] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.629] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0093.629] ResetEvent (hEvent=0x144) returned 1 [0093.629] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.755] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0093.755] ResetEvent (hEvent=0x144) returned 1 [0093.755] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.771] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0093.771] ResetEvent (hEvent=0x144) returned 1 [0093.771] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.819] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0093.819] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0093.819] GetProcessHeap () returned 0x840000 [0093.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0093.819] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0093.819] GetProcessHeap () returned 0x840000 [0093.820] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0093.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0093.820] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.820] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0093.820] GetProcessHeap () returned 0x840000 [0093.820] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.821] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.821] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0093.821] ResetEvent (hEvent=0x144) returned 1 [0093.821] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.843] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0093.843] ResetEvent (hEvent=0x144) returned 1 [0093.844] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.956] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0093.956] ResetEvent (hEvent=0x144) returned 1 [0093.956] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0093.967] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0093.968] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.968] GetProcessHeap () returned 0x840000 [0093.968] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.968] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0093.968] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0093.968] ResetEvent (hEvent=0x144) returned 1 [0093.968] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.069] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0094.069] ResetEvent (hEvent=0x144) returned 1 [0094.069] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.104] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0094.104] ResetEvent (hEvent=0x144) returned 1 [0094.104] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.147] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0094.147] ResetEvent (hEvent=0x144) returned 1 [0094.147] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.164] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0094.165] ResetEvent (hEvent=0x144) returned 1 [0094.165] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.471] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0094.471] ResetEvent (hEvent=0x144) returned 1 [0094.471] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.533] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0094.533] GetProcessHeap () returned 0x840000 [0094.533] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.534] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.534] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0094.534] GetProcessHeap () returned 0x840000 [0094.534] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0094.535] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.535] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0094.535] ResetEvent (hEvent=0x144) returned 1 [0094.535] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.547] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0094.547] ResetEvent (hEvent=0x144) returned 1 [0094.547] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.556] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0094.556] ResetEvent (hEvent=0x144) returned 1 [0094.556] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.576] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0094.576] ResetEvent (hEvent=0x144) returned 1 [0094.576] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.653] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0094.653] ResetEvent (hEvent=0x144) returned 1 [0094.653] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.718] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x27be9a0 | out: lpFindFileData=0x27be9a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0094.718] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0094.718] GetProcessHeap () returned 0x840000 [0094.718] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.719] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0094.722] ResetEvent (hEvent=0x144) returned 1 [0094.722] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.766] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0094.766] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.766] GetProcessHeap () returned 0x840000 [0094.766] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.767] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0094.767] ResetEvent (hEvent=0x144) returned 1 [0094.767] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.788] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0094.788] ResetEvent (hEvent=0x144) returned 1 [0094.788] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.806] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0094.835] ResetEvent (hEvent=0x144) returned 1 [0094.835] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.866] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0094.866] ResetEvent (hEvent=0x144) returned 1 [0094.866] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.926] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0094.926] ResetEvent (hEvent=0x144) returned 1 [0094.926] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.050] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0095.050] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0095.051] GetProcessHeap () returned 0x840000 [0095.051] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0095.051] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0095.051] GetProcessHeap () returned 0x840000 [0095.051] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0095.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0095.051] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.051] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0095.051] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0095.051] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0095.051] GetProcessHeap () returned 0x840000 [0095.051] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0095.051] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0095.051] GetProcessHeap () returned 0x840000 [0095.051] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0095.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0095.052] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.052] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0095.052] ResetEvent (hEvent=0x144) returned 1 [0095.052] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.070] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0095.070] ResetEvent (hEvent=0x144) returned 1 [0095.070] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.074] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0095.074] ResetEvent (hEvent=0x144) returned 1 [0095.074] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.153] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0095.153] ResetEvent (hEvent=0x144) returned 1 [0095.153] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.180] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0095.180] ResetEvent (hEvent=0x144) returned 1 [0095.180] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.195] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0095.195] ResetEvent (hEvent=0x144) returned 1 [0095.195] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.209] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0095.209] ResetEvent (hEvent=0x144) returned 1 [0095.209] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.218] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0095.218] ResetEvent (hEvent=0x144) returned 1 [0095.218] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.226] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0095.226] ResetEvent (hEvent=0x144) returned 1 [0095.226] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.297] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0095.297] ResetEvent (hEvent=0x144) returned 1 [0095.297] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.323] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0095.324] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0095.324] ResetEvent (hEvent=0x144) returned 1 [0095.324] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.400] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0095.400] ResetEvent (hEvent=0x144) returned 1 [0095.401] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.463] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0095.463] ResetEvent (hEvent=0x144) returned 1 [0095.463] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.573] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0095.573] ResetEvent (hEvent=0x144) returned 1 [0095.573] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.587] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0095.587] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0095.588] ResetEvent (hEvent=0x144) returned 1 [0095.588] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.655] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0095.655] ResetEvent (hEvent=0x144) returned 1 [0095.655] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.663] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0095.663] ResetEvent (hEvent=0x144) returned 1 [0095.663] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.691] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0095.691] ResetEvent (hEvent=0x144) returned 1 [0095.692] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.781] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0095.782] ResetEvent (hEvent=0x144) returned 1 [0095.782] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.848] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0095.848] ResetEvent (hEvent=0x144) returned 1 [0095.849] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0095.980] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0095.980] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0095.980] ResetEvent (hEvent=0x144) returned 1 [0095.980] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.055] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0096.055] ResetEvent (hEvent=0x144) returned 1 [0096.055] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.265] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0096.265] ResetEvent (hEvent=0x144) returned 1 [0096.265] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.286] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0096.286] ResetEvent (hEvent=0x144) returned 1 [0096.286] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.392] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0096.392] ResetEvent (hEvent=0x144) returned 1 [0096.392] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.470] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0096.470] ResetEvent (hEvent=0x144) returned 1 [0096.470] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.648] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0096.648] ResetEvent (hEvent=0x144) returned 1 [0096.648] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.660] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0096.660] ResetEvent (hEvent=0x144) returned 1 [0096.660] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.663] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0096.666] ResetEvent (hEvent=0x144) returned 1 [0096.667] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.675] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0096.675] ResetEvent (hEvent=0x144) returned 1 [0096.675] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.695] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0096.695] ResetEvent (hEvent=0x144) returned 1 [0096.695] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.824] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0096.824] ResetEvent (hEvent=0x144) returned 1 [0096.824] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0096.892] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0096.892] ResetEvent (hEvent=0x144) returned 1 [0096.892] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.011] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0097.011] ResetEvent (hEvent=0x144) returned 1 [0097.011] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.060] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0097.060] ResetEvent (hEvent=0x144) returned 1 [0097.060] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.132] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0097.132] ResetEvent (hEvent=0x144) returned 1 [0097.132] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.178] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0097.178] ResetEvent (hEvent=0x144) returned 1 [0097.178] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.248] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0097.248] ResetEvent (hEvent=0x144) returned 1 [0097.248] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.343] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0097.343] ResetEvent (hEvent=0x144) returned 1 [0097.344] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.357] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0097.360] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0097.360] ResetEvent (hEvent=0x144) returned 1 [0097.360] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.449] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0097.449] ResetEvent (hEvent=0x144) returned 1 [0097.449] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.461] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0097.461] ResetEvent (hEvent=0x144) returned 1 [0097.461] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.488] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0097.488] ResetEvent (hEvent=0x144) returned 1 [0097.488] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.556] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0097.556] ResetEvent (hEvent=0x144) returned 1 [0097.556] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.633] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0097.633] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0097.633] GetProcessHeap () returned 0x840000 [0097.633] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0097.633] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0097.633] GetProcessHeap () returned 0x840000 [0097.633] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0097.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0097.634] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.634] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0097.634] GetProcessHeap () returned 0x840000 [0097.634] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0097.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.635] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.635] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0097.635] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.635] GetProcessHeap () returned 0x840000 [0097.635] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0097.635] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0097.635] ResetEvent (hEvent=0x144) returned 1 [0097.635] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.792] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0097.792] ResetEvent (hEvent=0x144) returned 1 [0097.792] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.855] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0097.855] ResetEvent (hEvent=0x144) returned 1 [0097.855] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0097.998] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0097.998] ResetEvent (hEvent=0x144) returned 1 [0097.998] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.008] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0098.008] ResetEvent (hEvent=0x144) returned 1 [0098.009] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.270] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0098.270] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0098.270] GetProcessHeap () returned 0x840000 [0098.270] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ad0048 | out: hHeap=0x840000) returned 1 [0098.270] FindNextFileW (in: hFindFile=0x937a58, lpFindFileData=0x27bf150 | out: lpFindFileData=0x27bf150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0098.270] GetProcessHeap () returned 0x840000 [0098.270] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ad0048 [0098.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0098.271] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.271] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0098.271] GetProcessHeap () returned 0x840000 [0098.271] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0098.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0098.272] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.272] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0098.272] ResetEvent (hEvent=0x144) returned 1 [0098.272] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.347] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0098.347] ResetEvent (hEvent=0x144) returned 1 [0098.347] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.359] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.359] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.359] ResetEvent (hEvent=0x144) returned 1 [0098.359] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.390] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.390] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0098.390] GetProcessHeap () returned 0x840000 [0098.390] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0098.390] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0098.391] GetProcessHeap () returned 0x840000 [0098.391] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0098.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0098.391] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.391] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0098.391] ResetEvent (hEvent=0x144) returned 1 [0098.391] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.514] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0098.514] ResetEvent (hEvent=0x144) returned 1 [0098.514] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.586] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.587] ResetEvent (hEvent=0x144) returned 1 [0098.587] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.687] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.687] ResetEvent (hEvent=0x144) returned 1 [0098.687] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.753] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0098.753] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0098.754] GetProcessHeap () returned 0x840000 [0098.754] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0098.754] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0098.754] GetProcessHeap () returned 0x840000 [0098.754] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0098.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0098.754] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.754] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0098.754] ResetEvent (hEvent=0x144) returned 1 [0098.754] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.760] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0098.760] ResetEvent (hEvent=0x144) returned 1 [0098.760] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.842] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.843] ResetEvent (hEvent=0x144) returned 1 [0098.843] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0098.856] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.856] ResetEvent (hEvent=0x144) returned 1 [0098.856] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.203] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.203] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0099.203] GetProcessHeap () returned 0x840000 [0099.203] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0099.203] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0099.203] GetProcessHeap () returned 0x840000 [0099.203] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0099.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0099.204] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.204] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0099.204] ResetEvent (hEvent=0x144) returned 1 [0099.204] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.228] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0099.229] ResetEvent (hEvent=0x144) returned 1 [0099.229] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.239] ResetEvent (hEvent=0x144) returned 1 [0099.239] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.248] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.248] ResetEvent (hEvent=0x144) returned 1 [0099.248] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.478] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.478] ResetEvent (hEvent=0x144) returned 1 [0099.478] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.642] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0099.642] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0099.642] GetProcessHeap () returned 0x840000 [0099.642] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0099.643] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0099.643] GetProcessHeap () returned 0x840000 [0099.643] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0099.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0099.644] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.644] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0099.644] ResetEvent (hEvent=0x144) returned 1 [0099.644] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.689] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0099.689] ResetEvent (hEvent=0x144) returned 1 [0099.689] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0099.702] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.702] ResetEvent (hEvent=0x144) returned 1 [0099.702] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0100.251] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.251] ResetEvent (hEvent=0x144) returned 1 [0100.251] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0100.602] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.602] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0100.602] GetProcessHeap () returned 0x840000 [0100.602] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0100.602] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x27beec0 | out: lpFindFileData=0x27beec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0100.602] GetProcessHeap () returned 0x840000 [0100.602] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0100.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0100.602] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.602] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0100.602] ResetEvent (hEvent=0x144) returned 1 [0100.602] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0100.965] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x27bec30 | out: lpFindFileData=0x27bec30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0100.965] ResetEvent (hEvent=0x144) returned 1 [0100.965] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0101.719] ResetEvent (hEvent=0x144) returned 1 [0101.719] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0xb04 [0079.395] GetProcessHeap () returned 0x840000 [0079.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x38) returned 0x88deb8 [0079.395] GetProcessHeap () returned 0x840000 [0079.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x18) returned 0x8620e0 [0079.395] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x154 [0079.395] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x158 [0079.395] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x15c [0079.395] GetProcessHeap () returned 0x840000 [0079.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x88def8 [0079.395] GetProcessHeap () returned 0x840000 [0079.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0079.395] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0079.395] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0079.395] Wow64DisableWow64FsRedirection (in: OldValue=0x289f80c | out: OldValue=0x289f80c*=0x0) returned 1 [0079.395] GetProcessHeap () returned 0x840000 [0079.396] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0079.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x289f810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0079.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x289f810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168 [0079.402] GetProcessHeap () returned 0x840000 [0079.402] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8cffd8 [0079.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8dffe0 [0079.403] GetProcessHeap () returned 0x840000 [0079.403] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8e0020 [0079.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8f0028 [0079.403] FindNextFileW (in: hFindFile=0x8f0028, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.404] FindNextFileW (in: hFindFile=0x8f0028, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0079.404] GetProcessHeap () returned 0x840000 [0079.404] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f1070 [0079.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x901078 [0079.404] FindNextFileW (in: hFindFile=0x901078, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.404] FindNextFileW (in: hFindFile=0x901078, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x901078, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0079.414] FindClose (in: hFindFile=0x901078 | out: hFindFile=0x901078) returned 1 [0079.414] GetProcessHeap () returned 0x840000 [0079.414] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f1070 | out: hHeap=0x840000) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x8f0028, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0079.414] FindClose (in: hFindFile=0x8f0028 | out: hFindFile=0x8f0028) returned 1 [0079.414] GetProcessHeap () returned 0x840000 [0079.414] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8e0020 | out: hHeap=0x840000) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0079.414] GetProcessHeap () returned 0x840000 [0079.414] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8e0020 [0079.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9028c0 [0079.414] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0079.415] GetProcessHeap () returned 0x840000 [0079.415] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.415] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.416] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.416] GetProcessHeap () returned 0x840000 [0079.416] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0079.416] GetProcessHeap () returned 0x840000 [0079.416] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.416] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.416] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.416] GetProcessHeap () returned 0x840000 [0079.416] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0079.416] GetProcessHeap () returned 0x840000 [0079.416] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.417] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.418] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.418] GetProcessHeap () returned 0x840000 [0079.418] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0079.418] GetProcessHeap () returned 0x840000 [0079.418] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.418] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.418] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.418] GetProcessHeap () returned 0x840000 [0079.418] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.418] GetProcessHeap () returned 0x840000 [0079.418] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.419] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.419] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.419] GetProcessHeap () returned 0x840000 [0079.419] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0079.419] GetProcessHeap () returned 0x840000 [0079.419] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.421] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.421] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.421] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.421] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.421] GetProcessHeap () returned 0x840000 [0079.421] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.421] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0079.421] GetProcessHeap () returned 0x840000 [0079.421] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.421] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.421] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.421] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.421] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.421] GetProcessHeap () returned 0x840000 [0079.422] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.422] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0079.422] GetProcessHeap () returned 0x840000 [0079.422] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.422] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.422] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0079.422] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0079.423] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.423] GetProcessHeap () returned 0x840000 [0079.423] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0079.423] GetProcessHeap () returned 0x840000 [0079.423] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.424] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.424] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.424] GetProcessHeap () returned 0x840000 [0079.424] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0079.424] GetProcessHeap () returned 0x840000 [0079.424] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.424] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.424] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.424] GetProcessHeap () returned 0x840000 [0079.425] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.425] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0079.425] GetProcessHeap () returned 0x840000 [0079.425] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.425] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.425] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.425] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.426] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.426] GetProcessHeap () returned 0x840000 [0079.426] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.426] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0079.426] GetProcessHeap () returned 0x840000 [0079.426] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.426] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.426] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.426] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.426] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.426] GetProcessHeap () returned 0x840000 [0079.426] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.426] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0079.426] GetProcessHeap () returned 0x840000 [0079.426] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.427] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.427] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.427] GetProcessHeap () returned 0x840000 [0079.427] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0079.427] GetProcessHeap () returned 0x840000 [0079.427] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.428] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.428] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.428] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.428] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.428] GetProcessHeap () returned 0x840000 [0079.428] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.428] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0079.428] GetProcessHeap () returned 0x840000 [0079.428] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9000a0 [0079.429] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.429] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.429] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.429] FindClose (in: hFindFile=0x9000a0 | out: hFindFile=0x9000a0) returned 1 [0079.429] GetProcessHeap () returned 0x840000 [0079.429] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.429] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0079.429] GetProcessHeap () returned 0x840000 [0079.429] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9000a0 [0079.430] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.430] FindClose (in: hFindFile=0x9000a0 | out: hFindFile=0x9000a0) returned 1 [0079.430] GetProcessHeap () returned 0x840000 [0079.430] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0079.430] GetProcessHeap () returned 0x840000 [0079.430] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9000a0 [0079.431] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.431] FindClose (in: hFindFile=0x9000a0 | out: hFindFile=0x9000a0) returned 1 [0079.431] GetProcessHeap () returned 0x840000 [0079.431] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0079.431] GetProcessHeap () returned 0x840000 [0079.431] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9000a0 [0079.431] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x9000a0, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.431] FindClose (in: hFindFile=0x9000a0 | out: hFindFile=0x9000a0) returned 1 [0079.431] GetProcessHeap () returned 0x840000 [0079.431] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0079.432] GetProcessHeap () returned 0x840000 [0079.432] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.432] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.433] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.433] GetProcessHeap () returned 0x840000 [0079.433] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0079.433] GetProcessHeap () returned 0x840000 [0079.433] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.433] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.433] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.433] GetProcessHeap () returned 0x840000 [0079.433] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0079.433] GetProcessHeap () returned 0x840000 [0079.433] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.434] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.434] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.434] GetProcessHeap () returned 0x840000 [0079.434] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0079.435] GetProcessHeap () returned 0x840000 [0079.435] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.435] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.435] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.435] GetProcessHeap () returned 0x840000 [0079.435] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0079.435] GetProcessHeap () returned 0x840000 [0079.435] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.436] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.436] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.436] GetProcessHeap () returned 0x840000 [0079.436] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0079.436] GetProcessHeap () returned 0x840000 [0079.436] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.437] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.437] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.437] GetProcessHeap () returned 0x840000 [0079.437] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0079.437] FindClose (in: hFindFile=0x9028c0 | out: hFindFile=0x9028c0) returned 1 [0079.437] GetProcessHeap () returned 0x840000 [0079.437] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8e0020 | out: hHeap=0x840000) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0079.437] GetProcessHeap () returned 0x840000 [0079.437] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8e0020 [0079.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9028c0 [0079.438] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.438] FindClose (in: hFindFile=0x9028c0 | out: hFindFile=0x9028c0) returned 1 [0079.438] GetProcessHeap () returned 0x840000 [0079.438] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8e0020 | out: hHeap=0x840000) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0079.438] GetProcessHeap () returned 0x840000 [0079.438] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8e0020 [0079.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9028c0 [0079.438] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0079.439] GetProcessHeap () returned 0x840000 [0079.439] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x903908 [0079.440] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.441] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0079.441] GetProcessHeap () returned 0x840000 [0079.441] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x904950 [0079.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.442] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.442] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0079.442] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.443] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.443] GetProcessHeap () returned 0x840000 [0079.443] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x904950 | out: hHeap=0x840000) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0079.443] GetProcessHeap () returned 0x840000 [0079.443] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900030 [0079.446] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.446] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0079.446] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0079.446] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0079.446] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.446] FindNextFileW (in: hFindFile=0x900030, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.446] FindClose (in: hFindFile=0x900030 | out: hFindFile=0x900030) returned 1 [0079.447] GetProcessHeap () returned 0x840000 [0079.447] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.447] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0079.447] GetProcessHeap () returned 0x840000 [0079.447] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x900298 [0079.474] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.474] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0079.476] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0079.477] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0079.481] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.481] FindNextFileW (in: hFindFile=0x900298, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.489] FindClose (in: hFindFile=0x900298 | out: hFindFile=0x900298) returned 1 [0079.490] GetProcessHeap () returned 0x840000 [0079.490] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.491] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0079.491] GetProcessHeap () returned 0x840000 [0079.491] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.492] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.492] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0079.492] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0079.492] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0079.492] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.492] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.493] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.493] GetProcessHeap () returned 0x840000 [0079.493] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.493] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0079.493] GetProcessHeap () returned 0x840000 [0079.493] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.493] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0079.494] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.494] GetProcessHeap () returned 0x840000 [0079.494] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0079.494] GetProcessHeap () returned 0x840000 [0079.494] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.494] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0079.494] GetProcessHeap () returned 0x840000 [0079.494] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0079.495] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.495] GetProcessHeap () returned 0x840000 [0079.495] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.495] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0079.495] GetProcessHeap () returned 0x840000 [0079.495] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.495] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0079.496] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.496] GetProcessHeap () returned 0x840000 [0079.496] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0079.496] GetProcessHeap () returned 0x840000 [0079.496] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0079.496] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.496] GetProcessHeap () returned 0x840000 [0079.496] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.496] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0079.497] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0079.497] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.497] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.497] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.497] GetProcessHeap () returned 0x840000 [0079.497] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.497] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0079.498] GetProcessHeap () returned 0x840000 [0079.498] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.499] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.499] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.499] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.499] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0079.499] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.499] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.499] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.500] GetProcessHeap () returned 0x840000 [0079.500] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.500] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0079.500] GetProcessHeap () returned 0x840000 [0079.500] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.501] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.501] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0079.501] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.502] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.502] GetProcessHeap () returned 0x840000 [0079.502] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0079.502] GetProcessHeap () returned 0x840000 [0079.502] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0079.502] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0079.503] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.503] GetProcessHeap () returned 0x840000 [0079.503] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.503] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0079.503] GetProcessHeap () returned 0x840000 [0079.503] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.505] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.505] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0079.505] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0079.505] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0079.505] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.505] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.505] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.506] GetProcessHeap () returned 0x840000 [0079.506] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.506] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0079.506] GetProcessHeap () returned 0x840000 [0079.506] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.509] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.509] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0079.509] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0079.509] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0079.509] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.509] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.509] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.510] GetProcessHeap () returned 0x840000 [0079.510] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.510] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0079.510] GetProcessHeap () returned 0x840000 [0079.510] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.512] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.512] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0079.512] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0079.512] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0079.512] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.512] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.512] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.513] GetProcessHeap () returned 0x840000 [0079.513] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.513] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0079.513] GetProcessHeap () returned 0x840000 [0079.513] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.515] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.515] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0079.515] GetProcessHeap () returned 0x840000 [0079.515] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a18 [0079.516] FindNextFileW (in: hFindFile=0x937a18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x937a18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x937a18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0079.516] FindClose (in: hFindFile=0x937a18 | out: hFindFile=0x937a18) returned 1 [0079.516] GetProcessHeap () returned 0x840000 [0079.516] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0079.516] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0079.517] FindNextFileW (in: hFindFile=0x9379d8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.518] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.518] GetProcessHeap () returned 0x840000 [0079.518] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.518] GetProcessHeap () returned 0x840000 [0079.518] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9379d8 [0079.521] GetProcessHeap () returned 0x840000 [0079.521] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a18 [0079.524] FindClose (in: hFindFile=0x937a18 | out: hFindFile=0x937a18) returned 1 [0079.525] GetProcessHeap () returned 0x840000 [0079.525] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.525] FindClose (in: hFindFile=0x9379d8 | out: hFindFile=0x9379d8) returned 1 [0079.525] GetProcessHeap () returned 0x840000 [0079.525] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.525] GetProcessHeap () returned 0x840000 [0079.525] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bffa0 [0079.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.543] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.543] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.554] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.555] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0079.562] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0079.562] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0079.562] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0079.562] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0079.562] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0079.562] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0079.563] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0079.563] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0079.563] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.563] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.563] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.563] GetProcessHeap () returned 0x840000 [0079.563] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bffa0 | out: hHeap=0x840000) returned 1 [0079.563] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0079.564] GetProcessHeap () returned 0x840000 [0079.564] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0079.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.564] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.564] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.564] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.565] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0079.565] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.566] GetProcessHeap () returned 0x840000 [0079.566] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0079.566] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0079.566] GetProcessHeap () returned 0x840000 [0079.566] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0079.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0079.567] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0079.568] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0079.568] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0079.568] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0079.568] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.568] GetProcessHeap () returned 0x840000 [0079.568] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0079.568] FindNextFileW (in: hFindFile=0x903908, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0079.568] FindClose (in: hFindFile=0x903908 | out: hFindFile=0x903908) returned 1 [0079.569] GetProcessHeap () returned 0x840000 [0079.569] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.569] FindNextFileW (in: hFindFile=0x9028c0, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0079.569] FindClose (in: hFindFile=0x9028c0 | out: hFindFile=0x9028c0) returned 1 [0079.569] GetProcessHeap () returned 0x840000 [0079.569] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8e0020 | out: hHeap=0x840000) returned 1 [0079.570] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0079.570] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0079.570] GetProcessHeap () returned 0x840000 [0079.570] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0079.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.570] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.570] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0079.570] GetProcessHeap () returned 0x840000 [0079.570] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0079.571] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.571] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.571] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0079.571] GetProcessHeap () returned 0x840000 [0079.571] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0079.571] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0079.571] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0079.571] GetProcessHeap () returned 0x840000 [0079.571] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0079.572] FindNextFileW (in: hFindFile=0x8dffe0, lpFindFileData=0x289f580 | out: lpFindFileData=0x289f580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79ed58e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x79ed58e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0079.572] GetProcessHeap () returned 0x840000 [0079.572] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0079.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79ed58e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x79ed58e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0079.572] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79ed58e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x79ed58e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.573] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x768d45c0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768d45c0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0079.573] GetProcessHeap () returned 0x840000 [0079.573] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0079.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x768d45c0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768d45c0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0079.573] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x768d45c0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768d45c0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.573] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee5eedf0, ftCreationTime.dwHighDateTime=0x1d55859, ftLastAccessTime.dwLowDateTime=0x96ef3b60, ftLastAccessTime.dwHighDateTime=0x1d56411, ftLastWriteTime.dwLowDateTime=0x96ef3b60, ftLastWriteTime.dwHighDateTime=0x1d56411, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="consider.exe", cAlternateFileName="")) returned 1 [0079.573] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0079.573] GetProcessHeap () returned 0x840000 [0079.573] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8e0020 [0079.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0079.574] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0079.574] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0079.574] GetProcessHeap () returned 0x840000 [0079.574] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8e0020 | out: hHeap=0x840000) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905cfcc0, ftCreationTime.dwHighDateTime=0x1d55e52, ftLastAccessTime.dwLowDateTime=0x715ec660, ftLastAccessTime.dwHighDateTime=0x1d574ef, ftLastWriteTime.dwLowDateTime=0x715ec660, ftLastWriteTime.dwHighDateTime=0x1d574ef, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="images strict.exe", cAlternateFileName="IMAGES~1.EXE")) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0079.574] GetProcessHeap () returned 0x840000 [0079.574] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8e0020 [0079.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0079.574] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0079.575] GetProcessHeap () returned 0x840000 [0079.575] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0079.575] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.575] GetProcessHeap () returned 0x840000 [0079.575] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0079.575] GetProcessHeap () returned 0x840000 [0079.575] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0079.575] GetProcessHeap () returned 0x840000 [0079.575] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae1058 [0079.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0079.576] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0079.576] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0079.576] GetProcessHeap () returned 0x840000 [0079.576] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae1058 | out: hHeap=0x840000) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0079.577] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.577] GetProcessHeap () returned 0x840000 [0079.577] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0079.577] GetProcessHeap () returned 0x840000 [0079.577] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.577] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0079.577] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.577] GetProcessHeap () returned 0x840000 [0079.577] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0079.577] GetProcessHeap () returned 0x840000 [0079.577] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.578] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0079.578] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.578] GetProcessHeap () returned 0x840000 [0079.578] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0079.578] GetProcessHeap () returned 0x840000 [0079.578] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b18 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0079.581] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0079.581] FindNextFileW (in: hFindFile=0x937b18, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0079.581] FindClose (in: hFindFile=0x937b18 | out: hFindFile=0x937b18) returned 1 [0079.581] GetProcessHeap () returned 0x840000 [0079.581] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.581] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0079.581] GetProcessHeap () returned 0x840000 [0079.581] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0079.582] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.716] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0079.716] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0079.716] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0079.716] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0079.716] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0079.717] GetProcessHeap () returned 0x840000 [0079.717] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.717] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0079.717] GetProcessHeap () returned 0x840000 [0079.717] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0079.757] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.757] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0079.757] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0079.758] GetProcessHeap () returned 0x840000 [0079.758] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.758] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.758] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.758] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.758] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.758] GetProcessHeap () returned 0x840000 [0079.758] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.758] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0079.758] GetProcessHeap () returned 0x840000 [0079.758] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.758] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.758] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.758] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.758] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.758] GetProcessHeap () returned 0x840000 [0079.758] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.758] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0079.759] GetProcessHeap () returned 0x840000 [0079.759] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.759] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.759] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.759] GetProcessHeap () returned 0x840000 [0079.759] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0079.759] GetProcessHeap () returned 0x840000 [0079.759] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.759] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.759] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.759] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.760] GetProcessHeap () returned 0x840000 [0079.760] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.760] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0079.760] GetProcessHeap () returned 0x840000 [0079.760] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.760] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.760] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.760] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.760] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.760] GetProcessHeap () returned 0x840000 [0079.760] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.760] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0079.760] GetProcessHeap () returned 0x840000 [0079.760] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.760] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.760] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.760] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.760] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.761] GetProcessHeap () returned 0x840000 [0079.761] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.761] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.761] GetProcessHeap () returned 0x840000 [0079.761] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.761] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.761] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0079.762] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0079.763] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0079.763] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.764] GetProcessHeap () returned 0x840000 [0079.764] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.764] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0079.764] GetProcessHeap () returned 0x840000 [0079.764] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.764] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.764] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.764] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.764] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.764] GetProcessHeap () returned 0x840000 [0079.764] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.764] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0079.765] GetProcessHeap () returned 0x840000 [0079.765] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.765] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.765] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.765] GetProcessHeap () returned 0x840000 [0079.765] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0079.765] GetProcessHeap () returned 0x840000 [0079.765] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.765] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.765] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.765] GetProcessHeap () returned 0x840000 [0079.765] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0079.766] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0079.766] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0079.766] GetProcessHeap () returned 0x840000 [0079.766] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.766] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.766] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.766] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.766] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.766] GetProcessHeap () returned 0x840000 [0079.766] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.766] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0079.766] GetProcessHeap () returned 0x840000 [0079.766] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.766] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.766] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0079.766] GetProcessHeap () returned 0x840000 [0079.766] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.767] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.767] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0079.767] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0079.767] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.767] GetProcessHeap () returned 0x840000 [0079.767] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.767] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0079.767] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0079.767] GetProcessHeap () returned 0x840000 [0079.767] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.768] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0079.768] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.768] GetProcessHeap () returned 0x840000 [0079.768] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0079.768] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0079.768] GetProcessHeap () returned 0x840000 [0079.768] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0079.770] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.770] GetProcessHeap () returned 0x840000 [0079.771] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0079.771] GetProcessHeap () returned 0x840000 [0079.771] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.771] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0079.771] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.771] GetProcessHeap () returned 0x840000 [0079.771] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0079.771] GetProcessHeap () returned 0x840000 [0079.771] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.771] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0079.772] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.772] GetProcessHeap () returned 0x840000 [0079.772] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0079.772] GetProcessHeap () returned 0x840000 [0079.772] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.772] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0079.772] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.772] GetProcessHeap () returned 0x840000 [0079.772] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0079.772] GetProcessHeap () returned 0x840000 [0079.772] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0079.773] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.773] GetProcessHeap () returned 0x840000 [0079.773] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0079.773] GetProcessHeap () returned 0x840000 [0079.773] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0079.773] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.773] GetProcessHeap () returned 0x840000 [0079.773] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.773] GetProcessHeap () returned 0x840000 [0079.773] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0079.774] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.774] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.774] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.774] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.774] GetProcessHeap () returned 0x840000 [0079.774] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.775] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.775] GetProcessHeap () returned 0x840000 [0079.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.775] GetProcessHeap () returned 0x840000 [0079.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.775] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.775] GetProcessHeap () returned 0x840000 [0079.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.775] GetProcessHeap () returned 0x840000 [0079.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.775] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.775] GetProcessHeap () returned 0x840000 [0079.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.775] GetProcessHeap () returned 0x840000 [0079.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.775] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.776] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.776] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.776] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.776] GetProcessHeap () returned 0x840000 [0079.777] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.777] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.777] GetProcessHeap () returned 0x840000 [0079.777] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.777] GetProcessHeap () returned 0x840000 [0079.777] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.777] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.777] GetProcessHeap () returned 0x840000 [0079.777] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.777] GetProcessHeap () returned 0x840000 [0079.777] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.777] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.777] GetProcessHeap () returned 0x840000 [0079.777] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.777] GetProcessHeap () returned 0x840000 [0079.777] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.778] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.778] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.778] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.778] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.778] GetProcessHeap () returned 0x840000 [0079.778] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.779] GetProcessHeap () returned 0x840000 [0079.779] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.779] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.779] GetProcessHeap () returned 0x840000 [0079.779] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.779] GetProcessHeap () returned 0x840000 [0079.779] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.779] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.779] GetProcessHeap () returned 0x840000 [0079.779] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.779] GetProcessHeap () returned 0x840000 [0079.779] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.779] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.779] GetProcessHeap () returned 0x840000 [0079.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.780] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.780] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.780] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.780] GetProcessHeap () returned 0x840000 [0079.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.781] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.781] GetProcessHeap () returned 0x840000 [0079.781] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.781] GetProcessHeap () returned 0x840000 [0079.781] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.781] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.781] GetProcessHeap () returned 0x840000 [0079.781] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.781] GetProcessHeap () returned 0x840000 [0079.781] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.782] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.782] GetProcessHeap () returned 0x840000 [0079.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.782] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0079.782] GetProcessHeap () returned 0x840000 [0079.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.783] GetProcessHeap () returned 0x840000 [0079.783] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0079.784] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0079.784] GetProcessHeap () returned 0x840000 [0079.784] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.784] GetProcessHeap () returned 0x840000 [0079.784] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0079.784] GetProcessHeap () returned 0x840000 [0079.784] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.785] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.785] GetProcessHeap () returned 0x840000 [0079.785] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.785] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0079.785] GetProcessHeap () returned 0x840000 [0079.786] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0079.786] GetProcessHeap () returned 0x840000 [0079.786] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0079.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0079.787] GetProcessHeap () returned 0x840000 [0079.787] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.788] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.789] GetProcessHeap () returned 0x840000 [0079.789] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.789] GetProcessHeap () returned 0x840000 [0079.789] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.790] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0079.790] GetProcessHeap () returned 0x840000 [0079.790] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0079.790] GetProcessHeap () returned 0x840000 [0079.790] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0079.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0079.793] GetProcessHeap () returned 0x840000 [0079.793] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0079.798] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0079.798] GetProcessHeap () returned 0x840000 [0079.798] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.799] GetProcessHeap () returned 0x840000 [0079.799] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0079.812] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0079.815] GetProcessHeap () returned 0x840000 [0079.815] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b01068 | out: hHeap=0x840000) returned 1 [0079.816] GetProcessHeap () returned 0x840000 [0079.816] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.817] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.817] GetProcessHeap () returned 0x840000 [0079.817] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0079.817] GetProcessHeap () returned 0x840000 [0079.817] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.817] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.817] GetProcessHeap () returned 0x840000 [0079.817] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0079.817] GetProcessHeap () returned 0x840000 [0079.817] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.818] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.818] GetProcessHeap () returned 0x840000 [0079.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.819] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.819] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0079.819] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0079.819] GetProcessHeap () returned 0x840000 [0079.819] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b12078 [0079.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0080.032] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0080.033] GetProcessHeap () returned 0x840000 [0080.034] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b12078 | out: hHeap=0x840000) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0080.035] GetProcessHeap () returned 0x840000 [0080.035] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0080.035] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.035] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.035] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0080.035] GetProcessHeap () returned 0x840000 [0080.036] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0080.036] GetProcessHeap () returned 0x840000 [0080.036] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.036] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0080.036] GetProcessHeap () returned 0x840000 [0080.036] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0080.036] GetProcessHeap () returned 0x840000 [0080.036] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.036] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.037] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0080.037] GetProcessHeap () returned 0x840000 [0080.037] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.037] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0080.037] GetProcessHeap () returned 0x840000 [0080.037] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.226] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.226] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0080.226] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0080.226] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.226] GetProcessHeap () returned 0x840000 [0080.227] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.227] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0080.227] GetProcessHeap () returned 0x840000 [0080.227] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.315] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.315] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0080.315] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0080.315] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.315] GetProcessHeap () returned 0x840000 [0080.315] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.315] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0080.315] GetProcessHeap () returned 0x840000 [0080.315] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.412] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.412] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0080.412] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0080.412] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.413] GetProcessHeap () returned 0x840000 [0080.413] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.413] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0080.413] GetProcessHeap () returned 0x840000 [0080.413] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.413] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.413] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0080.413] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.413] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.413] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.413] GetProcessHeap () returned 0x840000 [0080.413] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.413] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0080.413] GetProcessHeap () returned 0x840000 [0080.413] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.547] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.547] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0080.547] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.547] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.547] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.547] GetProcessHeap () returned 0x840000 [0080.548] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.548] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0080.548] GetProcessHeap () returned 0x840000 [0080.548] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.645] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.645] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0080.646] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.646] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.646] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.646] GetProcessHeap () returned 0x840000 [0080.646] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.646] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0080.646] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0080.646] GetProcessHeap () returned 0x840000 [0080.646] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.795] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.795] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.795] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0080.795] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0080.795] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.795] GetProcessHeap () returned 0x840000 [0080.795] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.795] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0080.795] GetProcessHeap () returned 0x840000 [0080.795] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.796] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.796] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.796] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0080.796] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0080.796] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.796] GetProcessHeap () returned 0x840000 [0080.796] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.796] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0080.796] GetProcessHeap () returned 0x840000 [0080.796] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0080.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0080.902] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0080.902] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0080.902] GetProcessHeap () returned 0x840000 [0080.902] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0080.902] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0080.903] GetProcessHeap () returned 0x840000 [0080.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0080.903] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0080.903] GetProcessHeap () returned 0x840000 [0080.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0080.904] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0080.904] GetProcessHeap () returned 0x840000 [0080.904] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0080.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0080.905] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.905] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0080.905] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0080.905] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0080.905] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0080.906] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0080.907] GetProcessHeap () returned 0x840000 [0080.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0080.907] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0080.907] GetProcessHeap () returned 0x840000 [0080.907] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0080.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0081.010] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.010] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0081.010] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0081.010] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0081.010] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0081.010] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0081.010] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0081.010] GetProcessHeap () returned 0x840000 [0081.010] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0081.010] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0081.010] GetProcessHeap () returned 0x840000 [0081.010] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0081.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0081.111] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.111] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0081.111] GetProcessHeap () returned 0x840000 [0081.111] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0081.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.256] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0081.256] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.257] GetProcessHeap () returned 0x840000 [0081.257] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0081.257] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0081.257] GetProcessHeap () returned 0x840000 [0081.257] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b11fc8 [0081.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.366] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0081.366] GetProcessHeap () returned 0x840000 [0081.366] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0081.366] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0081.366] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0081.366] GetProcessHeap () returned 0x840000 [0081.367] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0081.367] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.367] GetProcessHeap () returned 0x840000 [0081.367] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b11fc8 | out: hHeap=0x840000) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0081.367] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0081.367] GetProcessHeap () returned 0x840000 [0081.367] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0081.367] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0081.367] GetProcessHeap () returned 0x840000 [0081.367] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0081.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0081.500] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.500] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0081.500] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0081.500] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0081.500] GetProcessHeap () returned 0x840000 [0081.500] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0081.500] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0081.500] GetProcessHeap () returned 0x840000 [0081.500] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0081.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0081.890] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0081.892] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0081.893] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0081.894] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0081.894] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0081.895] GetProcessHeap () returned 0x840000 [0081.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0081.895] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0081.895] GetProcessHeap () returned 0x840000 [0081.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0081.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0081.895] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.895] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0081.895] GetProcessHeap () returned 0x840000 [0081.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.896] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.896] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.896] GetProcessHeap () returned 0x840000 [0081.896] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0081.896] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0081.896] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0081.896] GetProcessHeap () returned 0x840000 [0081.896] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0081.897] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0081.897] GetProcessHeap () returned 0x840000 [0081.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af1060 [0081.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0081.900] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.944] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0081.944] GetProcessHeap () returned 0x840000 [0081.944] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.945] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.945] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0081.945] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0081.945] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.945] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.945] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.945] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.945] GetProcessHeap () returned 0x840000 [0081.945] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.945] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0081.945] GetProcessHeap () returned 0x840000 [0081.945] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.948] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.948] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.948] GetProcessHeap () returned 0x840000 [0081.948] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.948] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0081.949] GetProcessHeap () returned 0x840000 [0081.949] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.949] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.949] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0081.949] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0081.949] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.950] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.950] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.950] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.950] GetProcessHeap () returned 0x840000 [0081.950] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.950] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0081.950] GetProcessHeap () returned 0x840000 [0081.950] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.951] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.951] GetProcessHeap () returned 0x840000 [0081.951] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0081.951] GetProcessHeap () returned 0x840000 [0081.951] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0081.951] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0081.952] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.952] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.952] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.952] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.952] GetProcessHeap () returned 0x840000 [0081.952] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.952] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0081.952] GetProcessHeap () returned 0x840000 [0081.952] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.953] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.953] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.953] GetProcessHeap () returned 0x840000 [0081.953] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.953] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0081.953] GetProcessHeap () returned 0x840000 [0081.953] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.954] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.954] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0081.954] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0081.954] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.954] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.954] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.954] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.954] GetProcessHeap () returned 0x840000 [0081.954] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.954] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0081.954] GetProcessHeap () returned 0x840000 [0081.955] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.955] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.955] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0081.955] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0081.955] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.956] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.956] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.956] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.956] GetProcessHeap () returned 0x840000 [0081.956] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.956] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0081.956] GetProcessHeap () returned 0x840000 [0081.956] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.957] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.957] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.957] GetProcessHeap () returned 0x840000 [0081.957] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.957] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0081.957] GetProcessHeap () returned 0x840000 [0081.957] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.958] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.958] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0081.958] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0081.958] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.958] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.958] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.958] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.958] GetProcessHeap () returned 0x840000 [0081.958] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.958] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0081.959] GetProcessHeap () returned 0x840000 [0081.959] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.959] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.959] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0081.959] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0081.959] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.959] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.960] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.960] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.960] GetProcessHeap () returned 0x840000 [0081.960] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.960] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0081.960] GetProcessHeap () returned 0x840000 [0081.960] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.961] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.961] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0081.961] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0081.961] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.961] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.961] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.961] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.961] GetProcessHeap () returned 0x840000 [0081.961] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.961] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0081.961] GetProcessHeap () returned 0x840000 [0081.961] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.962] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.962] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.962] GetProcessHeap () returned 0x840000 [0081.962] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.962] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0081.962] GetProcessHeap () returned 0x840000 [0081.962] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.963] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.963] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0081.963] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0081.963] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.963] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.963] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.963] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.963] GetProcessHeap () returned 0x840000 [0081.963] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.963] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0081.964] GetProcessHeap () returned 0x840000 [0081.964] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.964] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.965] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0081.965] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0081.965] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.965] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.965] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.965] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.965] GetProcessHeap () returned 0x840000 [0081.965] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.965] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0081.965] GetProcessHeap () returned 0x840000 [0081.965] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.966] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.966] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0081.966] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0081.966] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.966] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.966] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.966] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.966] GetProcessHeap () returned 0x840000 [0081.966] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.966] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0081.966] GetProcessHeap () returned 0x840000 [0081.966] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.967] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.967] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0081.967] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0081.967] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.967] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.967] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.968] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.968] GetProcessHeap () returned 0x840000 [0081.968] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.968] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0081.968] GetProcessHeap () returned 0x840000 [0081.968] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.968] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.969] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.969] GetProcessHeap () returned 0x840000 [0081.969] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0081.969] GetProcessHeap () returned 0x840000 [0081.969] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0081.969] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0081.970] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.970] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.970] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.970] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.970] GetProcessHeap () returned 0x840000 [0081.970] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.970] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0081.970] GetProcessHeap () returned 0x840000 [0081.970] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.971] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.971] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0081.971] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0081.971] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.971] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.971] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.971] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.971] GetProcessHeap () returned 0x840000 [0081.971] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.971] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0081.971] GetProcessHeap () returned 0x840000 [0081.971] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.972] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.972] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0081.972] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0081.972] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0081.972] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0081.972] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0081.972] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.972] GetProcessHeap () returned 0x840000 [0081.973] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.973] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0081.973] GetProcessHeap () returned 0x840000 [0081.973] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0081.973] FindNextFileW (in: hFindFile=0x937b98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.973] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0081.973] GetProcessHeap () returned 0x840000 [0081.973] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0081.973] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8f0028 [0081.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b98 [0082.081] FindClose (in: hFindFile=0x937b98 | out: hFindFile=0x937b98) returned 1 [0082.081] GetProcessHeap () returned 0x840000 [0082.081] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.202] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.202] GetProcessHeap () returned 0x840000 [0082.202] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.369] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.369] GetProcessHeap () returned 0x840000 [0082.369] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.370] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.370] GetProcessHeap () returned 0x840000 [0082.370] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.573] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.573] GetProcessHeap () returned 0x840000 [0082.573] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.573] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.573] GetProcessHeap () returned 0x840000 [0082.573] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.713] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.713] GetProcessHeap () returned 0x840000 [0082.713] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.822] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.822] GetProcessHeap () returned 0x840000 [0082.822] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.916] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.916] GetProcessHeap () returned 0x840000 [0082.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0082.916] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0082.916] GetProcessHeap () returned 0x840000 [0082.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0082.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.077] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.077] GetProcessHeap () returned 0x840000 [0083.077] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.077] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.078] GetProcessHeap () returned 0x840000 [0083.078] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.165] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.165] GetProcessHeap () returned 0x840000 [0083.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.165] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.165] GetProcessHeap () returned 0x840000 [0083.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.259] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.259] GetProcessHeap () returned 0x840000 [0083.259] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.313] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.313] GetProcessHeap () returned 0x840000 [0083.313] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.461] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.461] GetProcessHeap () returned 0x840000 [0083.461] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.554] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.554] GetProcessHeap () returned 0x840000 [0083.554] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.648] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.648] GetProcessHeap () returned 0x840000 [0083.648] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.648] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.648] GetProcessHeap () returned 0x840000 [0083.648] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.695] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.695] GetProcessHeap () returned 0x840000 [0083.695] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.835] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.836] GetProcessHeap () returned 0x840000 [0083.836] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0083.836] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0083.836] GetProcessHeap () returned 0x840000 [0083.836] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0083.836] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0083.836] GetProcessHeap () returned 0x840000 [0083.836] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0083.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0083.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.116] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.116] GetProcessHeap () returned 0x840000 [0084.116] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.210] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.210] GetProcessHeap () returned 0x840000 [0084.210] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.210] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.210] GetProcessHeap () returned 0x840000 [0084.210] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.210] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.211] GetProcessHeap () returned 0x840000 [0084.211] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.304] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.304] GetProcessHeap () returned 0x840000 [0084.304] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.397] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.397] GetProcessHeap () returned 0x840000 [0084.397] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.397] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0084.397] GetProcessHeap () returned 0x840000 [0084.397] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0084.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0084.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.522] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.522] GetProcessHeap () returned 0x840000 [0084.522] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.522] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0084.522] GetProcessHeap () returned 0x840000 [0084.522] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0084.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0084.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0084.866] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0084.866] GetProcessHeap () returned 0x840000 [0084.866] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0084.866] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.867] GetProcessHeap () returned 0x840000 [0084.867] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.867] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0084.867] GetProcessHeap () returned 0x840000 [0084.867] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0084.867] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0084.993] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0084.993] GetProcessHeap () returned 0x840000 [0084.993] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0084.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0084.994] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0084.994] GetProcessHeap () returned 0x840000 [0084.994] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0084.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0084.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0084.997] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0084.997] GetProcessHeap () returned 0x840000 [0084.997] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0084.998] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0084.998] GetProcessHeap () returned 0x840000 [0084.998] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0084.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0085.045] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0085.045] GetProcessHeap () returned 0x840000 [0085.045] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.045] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.045] GetProcessHeap () returned 0x840000 [0085.046] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0085.046] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.046] GetProcessHeap () returned 0x840000 [0085.046] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0085.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.047] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.047] GetProcessHeap () returned 0x840000 [0085.047] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0085.047] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.047] GetProcessHeap () returned 0x840000 [0085.047] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0085.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0085.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0085.049] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0085.049] GetProcessHeap () returned 0x840000 [0085.049] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbe8c0 | out: hHeap=0x840000) returned 1 [0085.049] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0085.050] GetProcessHeap () returned 0x840000 [0085.050] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.050] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.050] GetProcessHeap () returned 0x840000 [0085.050] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8f0028 | out: hHeap=0x840000) returned 1 [0085.050] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.050] GetProcessHeap () returned 0x840000 [0085.050] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0085.051] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0085.052] GetProcessHeap () returned 0x840000 [0085.052] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8e0020 | out: hHeap=0x840000) returned 1 [0085.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0085.053] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0085.053] GetProcessHeap () returned 0x840000 [0085.053] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0085.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0085.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0085.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0085.056] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0085.056] GetProcessHeap () returned 0x840000 [0085.056] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0085.056] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0085.056] GetProcessHeap () returned 0x840000 [0085.056] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0085.056] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.056] GetProcessHeap () returned 0x840000 [0085.056] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0085.056] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.056] GetProcessHeap () returned 0x840000 [0085.056] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.058] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0085.058] GetProcessHeap () returned 0x840000 [0085.058] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0085.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0085.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.062] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.062] GetProcessHeap () returned 0x840000 [0085.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0085.062] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.062] GetProcessHeap () returned 0x840000 [0085.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.062] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.062] GetProcessHeap () returned 0x840000 [0085.062] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.396] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.397] GetProcessHeap () returned 0x840000 [0085.397] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0085.397] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.398] GetProcessHeap () returned 0x840000 [0085.398] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.536] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.536] GetProcessHeap () returned 0x840000 [0085.536] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0085.536] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.536] GetProcessHeap () returned 0x840000 [0085.536] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0085.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0085.617] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0085.617] GetProcessHeap () returned 0x840000 [0085.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0085.617] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0085.617] GetProcessHeap () returned 0x840000 [0085.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0085.617] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0085.617] GetProcessHeap () returned 0x840000 [0085.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0085.617] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0085.618] GetProcessHeap () returned 0x840000 [0085.618] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0085.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0085.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0085.620] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0085.622] GetProcessHeap () returned 0x840000 [0085.622] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0085.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0085.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0086.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.269] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.270] GetProcessHeap () returned 0x840000 [0086.270] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.362] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.363] GetProcessHeap () returned 0x840000 [0086.363] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.458] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.458] GetProcessHeap () returned 0x840000 [0086.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.549] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.550] GetProcessHeap () returned 0x840000 [0086.550] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.832] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.833] GetProcessHeap () returned 0x840000 [0086.833] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.835] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.836] GetProcessHeap () returned 0x840000 [0086.836] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.877] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x289e8b0) [0086.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.879] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.880] GetProcessHeap () returned 0x840000 [0086.880] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.881] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.882] GetProcessHeap () returned 0x840000 [0086.882] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.884] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.884] GetProcessHeap () returned 0x840000 [0086.884] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.886] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.887] GetProcessHeap () returned 0x840000 [0086.887] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.888] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.889] GetProcessHeap () returned 0x840000 [0086.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.890] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.891] GetProcessHeap () returned 0x840000 [0086.891] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.893] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.893] GetProcessHeap () returned 0x840000 [0086.893] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.895] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.896] GetProcessHeap () returned 0x840000 [0086.896] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.897] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.898] GetProcessHeap () returned 0x840000 [0086.898] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.899] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.900] GetProcessHeap () returned 0x840000 [0086.900] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.902] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.902] GetProcessHeap () returned 0x840000 [0086.902] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.904] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.904] GetProcessHeap () returned 0x840000 [0086.904] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.905] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.905] GetProcessHeap () returned 0x840000 [0086.905] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0086.906] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0086.907] GetProcessHeap () returned 0x840000 [0086.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0086.907] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0086.907] GetProcessHeap () returned 0x840000 [0086.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0086.907] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0086.907] GetProcessHeap () returned 0x840000 [0086.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0086.907] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0086.907] GetProcessHeap () returned 0x840000 [0086.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0086.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0086.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0086.910] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0086.910] GetProcessHeap () returned 0x840000 [0086.910] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0086.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0086.911] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0086.911] GetProcessHeap () returned 0x840000 [0086.911] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0086.911] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0086.911] GetProcessHeap () returned 0x840000 [0086.911] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0086.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x768ae460, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768ae460, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0086.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0086.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.425] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.425] GetProcessHeap () returned 0x840000 [0087.425] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0087.427] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0087.427] GetProcessHeap () returned 0x840000 [0087.427] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0087.427] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.427] GetProcessHeap () returned 0x840000 [0087.427] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.427] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.427] GetProcessHeap () returned 0x840000 [0087.427] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.428] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0087.428] GetProcessHeap () returned 0x840000 [0087.428] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0087.428] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0087.428] GetProcessHeap () returned 0x840000 [0087.428] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0087.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76888300, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76888300, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0087.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0087.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.467] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.470] GetProcessHeap () returned 0x840000 [0087.470] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.472] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.473] GetProcessHeap () returned 0x840000 [0087.473] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.473] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.473] GetProcessHeap () returned 0x840000 [0087.473] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.473] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0087.473] GetProcessHeap () returned 0x840000 [0087.473] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0087.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0087.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.644] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.645] GetProcessHeap () returned 0x840000 [0087.645] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.648] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.648] GetProcessHeap () returned 0x840000 [0087.648] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.650] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.651] GetProcessHeap () returned 0x840000 [0087.651] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.651] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0087.651] GetProcessHeap () returned 0x840000 [0087.651] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0087.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0087.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.654] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.654] GetProcessHeap () returned 0x840000 [0087.654] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.655] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.655] GetProcessHeap () returned 0x840000 [0087.655] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.656] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.656] GetProcessHeap () returned 0x840000 [0087.656] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.660] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.660] GetProcessHeap () returned 0x840000 [0087.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.665] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.666] GetProcessHeap () returned 0x840000 [0087.666] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.669] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.670] GetProcessHeap () returned 0x840000 [0087.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.670] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0087.670] GetProcessHeap () returned 0x840000 [0087.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0087.670] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0087.670] GetProcessHeap () returned 0x840000 [0087.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0087.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0087.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0087.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.675] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.675] GetProcessHeap () returned 0x840000 [0087.675] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.676] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.677] GetProcessHeap () returned 0x840000 [0087.677] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0087.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0087.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0087.685] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0087.685] GetProcessHeap () returned 0x840000 [0087.685] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0087.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0087.686] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0087.686] GetProcessHeap () returned 0x840000 [0087.686] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0087.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0087.687] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0087.687] GetProcessHeap () returned 0x840000 [0087.687] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0087.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.853] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.853] GetProcessHeap () returned 0x840000 [0087.853] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0087.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.870] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.870] GetProcessHeap () returned 0x840000 [0087.870] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.870] GetProcessHeap () returned 0x840000 [0087.870] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.871] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.871] GetProcessHeap () returned 0x840000 [0087.871] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.871] GetProcessHeap () returned 0x840000 [0087.871] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.892] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.892] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.892] GetProcessHeap () returned 0x840000 [0087.892] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime", cAlternateFileName="")) returned 1 [0087.893] GetProcessHeap () returned 0x840000 [0087.893] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.894] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.894] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.894] GetProcessHeap () returned 0x840000 [0087.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x715, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis", cAlternateFileName="")) returned 1 [0087.894] GetProcessHeap () returned 0x840000 [0087.894] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.895] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.895] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.895] GetProcessHeap () returned 0x840000 [0087.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79023600, ftCreationTime.dwHighDateTime=0x1ca2b70, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79023600, ftLastWriteTime.dwHighDateTime=0x1ca2b70, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dfe600, ftCreationTime.dwHighDateTime=0x1ca2b73, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x60dfe600, ftLastWriteTime.dwHighDateTime=0x1ca2b73, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate", cAlternateFileName="")) returned 1 [0087.897] GetProcessHeap () returned 0x840000 [0087.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.897] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.897] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.897] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.898] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.898] GetProcessHeap () returned 0x840000 [0087.898] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0087.898] GetProcessHeap () returned 0x840000 [0087.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.898] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.898] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.898] GetProcessHeap () returned 0x840000 [0087.898] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.899] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0087.899] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions", cAlternateFileName="SOLUTI~1")) returned 1 [0087.899] GetProcessHeap () returned 0x840000 [0087.899] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow.png", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x931, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document.gif", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x832, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.gif", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gradient.png", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Main.gif", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Person.gif", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Response.gif", cAlternateFileName="")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Response.gif", cAlternateFileName="")) returned 0 [0087.901] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.902] GetProcessHeap () returned 0x840000 [0087.902] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions.css", cAlternateFileName="SOLUTI~1.CSS")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Doc.css", cAlternateFileName="SOLUTI~2.CSS")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Generic.css", cAlternateFileName="SOLUTI~3.CSS")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Person.css", cAlternateFileName="SOLUTI~4.CSS")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Response.css", cAlternateFileName="SOB0ED~1.CSS")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0087.902] GetProcessHeap () returned 0x840000 [0087.902] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.903] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.903] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0087.903] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.903] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.903] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.903] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.903] GetProcessHeap () returned 0x840000 [0087.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.903] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0087.904] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0087.904] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STS2", cAlternateFileName="")) returned 1 [0087.904] GetProcessHeap () returned 0x840000 [0087.904] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.904] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.904] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0087.905] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0087.905] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.905] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.905] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.905] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.905] GetProcessHeap () returned 0x840000 [0087.905] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.905] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0087.905] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl", cAlternateFileName="")) returned 1 [0087.905] GetProcessHeap () returned 0x840000 [0087.905] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0087.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0087.906] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0087.906] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0087.906] GetProcessHeap () returned 0x840000 [0087.906] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x727, dwReserved0=0x0, dwReserved1=0x0, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0087.906] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0087.907] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 0 [0087.907] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0087.907] GetProcessHeap () returned 0x840000 [0087.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0087.907] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 0 [0087.907] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0087.907] GetProcessHeap () returned 0x840000 [0087.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC", cAlternateFileName="GROOVE~1.HXC")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT", cAlternateFileName="GROOVE~1.HXT")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK", cAlternateFileName="GROOVE~1.HXK")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK", cAlternateFileName="GROOVE~2.HXK")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.VSL", cAlternateFileName="")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDIFF.VRD", cAlternateFileName="")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDUCT.VRD", cAlternateFileName="")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x75790, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFINTL.DLL", cAlternateFileName="")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x174d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.HXS", cAlternateFileName="")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x697e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR.HXS", cAlternateFileName="INFOPA~1.HXS")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXC", cAlternateFileName="INFOPA~2.HXC")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXT", cAlternateFileName="INFOPA~2.HXT")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_F_COL.HXK", cAlternateFileName="INFOPA~3.HXK")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_K_COL.HXK", cAlternateFileName="INFOPA~4.HXK")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXC", cAlternateFileName="INFOPA~1.HXC")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXT", cAlternateFileName="INFOPA~1.HXT")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_F_COL.HXK", cAlternateFileName="INFOPA~1.HXK")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_K_COL.HXK", cAlternateFileName="INFOPA~2.HXK")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108a400, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x108a400, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTLIST.VRD", cAlternateFileName="")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37deba00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x37deba00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVENTRY.VRD", cAlternateFileName="")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3491f00, ftCreationTime.dwHighDateTime=0x1ca0f52, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3491f00, ftLastWriteTime.dwHighDateTime=0x1ca0f52, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Invite or Link.one", cAlternateFileName="INVITE~1.ONE")) returned 1 [0087.910] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x22a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDSINTL.DLL", cAlternateFileName="")) returned 1 [0087.910] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xd7b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDINTL.DLL", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLKINTL.DLL", cAlternateFileName="IPOLKI~1.DLL")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x3cebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issue Tracking.gta", cAlternateFileName="ISSUET~1.GTA")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JADE.CSS", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xafe69b00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9980, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.VSL", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x112970, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.IDX_DLL", cAlternateFileName="MAPIRD~1.IDX")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x100fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MERES.DLL", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6cf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.DLL", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x9b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.IDX_DLL", cAlternateFileName="MOR6IN~1.IDX")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00b00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b00b00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOVE.VRD", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x3178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXRES.DLL", cAlternateFileName="")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0xa3f874, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV.HXS", cAlternateFileName="MSACCE~1.HXS")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXC", cAlternateFileName="MSACCE~1.HXC")) returned 1 [0087.911] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXT", cAlternateFileName="MSACCE~1.HXT")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_F_COL.HXK", cAlternateFileName="MSACCE~1.HXK")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_K_COL.HXK", cAlternateFileName="MSACCE~2.HXK")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS", cAlternateFileName="")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC", cAlternateFileName="MSACCE~2.HXC")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT", cAlternateFileName="MSACCE~2.HXT")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK", cAlternateFileName="MSACCE~3.HXK")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK", cAlternateFileName="MSACCE~4.HXK")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x127f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAIN.DLL", cAlternateFileName="")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589e0a00, ftCreationTime.dwHighDateTime=0x1c99224, ftLastAccessTime.dwLowDateTime=0x980ce30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x589e0a00, ftLastWriteTime.dwHighDateTime=0x1c99224, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15bf200, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe15bf200, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x69560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS", cAlternateFileName="")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC", cAlternateFileName="MSOUC_~1.HXC")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT", cAlternateFileName="MSOUC_~1.HXT")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK", cAlternateFileName="MSOUC_~1.HXK")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK", cAlternateFileName="MSOUC_~2.HXK")) returned 1 [0087.912] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x487dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV.HXS", cAlternateFileName="MSPUBD~1.HXS")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXC", cAlternateFileName="MSPUBD~1.HXC")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXT", cAlternateFileName="MSPUBD~1.HXT")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_F_COL.HXK", cAlternateFileName="MSPUBD~1.HXK")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_K_COL.HXK", cAlternateFileName="MSPUBD~2.HXK")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1cc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.HXS", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe30400, ftCreationTime.dwHighDateTime=0x1c2a1b4, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fe30400, ftLastWriteTime.dwHighDateTime=0x1c2a1b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.OPG", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXC", cAlternateFileName="MSPUB_~1.HXC")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXT", cAlternateFileName="MSPUB_~1.HXT")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK", cAlternateFileName="MSPUB_~1.HXK")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK", cAlternateFileName="MSPUB_~2.HXK")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8527700, ftCreationTime.dwHighDateTime=0x1c33a9f, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd8527700, ftLastWriteTime.dwHighDateTime=0x1c33a9f, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.CHM", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x15d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTINTL.DLL", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x5f254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.HXS", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXC", cAlternateFileName="MSTORE~1.HXC")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXT", cAlternateFileName="MSTORE~1.HXT")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_F_COL.HXK", cAlternateFileName="MSTORE~1.HXK")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_K_COL.HXK", cAlternateFileName="MSTORE~2.HXK")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.CSS", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK1.VRD", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK2.VRD", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK3.VRD", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeefd00, ftCreationTime.dwHighDateTime=0x1c2c076, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeaeefd00, ftLastWriteTime.dwHighDateTime=0x1c2c076, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCCMPVRD.XML", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b675400, ftCreationTime.dwHighDateTime=0x1c2c0e2, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4b675400, ftLastWriteTime.dwHighDateTime=0x1c2c0e2, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCMODVRD.XML", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde567d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xde567d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x81380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWCI.DLL", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6fd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.HXS", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISINTL.DLL", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXC", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXT", cAlternateFileName="")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_F_COL.HXK", cAlternateFileName="OIS_F_~1.HXK")) returned 1 [0087.916] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_K_COL.HXK", cAlternateFileName="OIS_K_~1.HXK")) returned 1 [0087.917] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de21e00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8de21e00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x62180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL", cAlternateFileName="")) returned 1 [0087.917] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70618400, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70618400, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.IDX_DLL", cAlternateFileName="OMSINT~1.IDX")) returned 1 [0087.917] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xdf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONELEV.EXE", cAlternateFileName="")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.HXS", cAlternateFileName="")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfa4f00, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabfa4f00, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x25e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteSyncPCIntl.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC", cAlternateFileName="ONENOT~1.HXC")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT", cAlternateFileName="ONENOT~1.HXT")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK", cAlternateFileName="ONENOT~1.HXK")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK", cAlternateFileName="ONENOT~2.HXK")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96d3b00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb96d3b00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x148d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONGuide.onepkg", cAlternateFileName="ONGUID~1.ONE")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x341f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL", cAlternateFileName="")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.IDX_DLL", cAlternateFileName="ONINTL~1.IDX")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.IDX_DLL", cAlternateFileName="ONINTL~2.IDX")) returned 1 [0087.921] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50af3f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCH.VRD", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.VSL", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGPOS.VRD", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x105b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.VSL", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4790, dwReserved0=0x0, dwReserved1=0x0, cFileName="ospintl.dll", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8c4100, ftCreationTime.dwHighDateTime=0x1c67eda, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed8c4100, ftLastWriteTime.dwHighDateTime=0x1c67eda, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTFORM.DAT", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fc5400, ftCreationTime.dwHighDateTime=0x1ca0f51, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fc5400, ftLastWriteTime.dwHighDateTime=0x1ca0f51, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLBAR.INF", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x13f0930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x644d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL", cAlternateFileName="")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1d380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.IDX_DLL", cAlternateFileName="OUTLLI~1.IDX")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x1416a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x46f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.IDX_DLL", cAlternateFileName="OUTLLI~2.IDX")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80e2700, ftCreationTime.dwHighDateTime=0x1ca8f17, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80e2700, ftLastWriteTime.dwHighDateTime=0x1ca8f17, nFileSizeHigh=0x0, nFileSizeLow=0x6aa3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV.HXS", cAlternateFileName="OUTLOO~1.HXS")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXC", cAlternateFileName="OUTLOO~1.HXC")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXT", cAlternateFileName="OUTLOO~1.HXT")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_F_COL.HXK", cAlternateFileName="OUTLOO~1.HXK")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_K_COL.HXK", cAlternateFileName="OUTLOO~2.HXK")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3475b500, ftCreationTime.dwHighDateTime=0x1ca95bc, ftLastAccessTime.dwLowDateTime=0x1488eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3475b500, ftLastWriteTime.dwHighDateTime=0x1ca95bc, nFileSizeHigh=0x0, nFileSizeLow=0x13a57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HOL", cAlternateFileName="")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ede2d00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ede2d00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HXS", cAlternateFileName="")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC", cAlternateFileName="OUTLOO~2.HXC")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT", cAlternateFileName="OUTLOO~2.HXT")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK", cAlternateFileName="OUTLOO~3.HXK")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_K_COL.HXK", cAlternateFileName="OUTLOO~4.HXK")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.H", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.INI", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1f760, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x2b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.IDX_DLL", cAlternateFileName="OUTLWV~1.IDX")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSPORT.CSS", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASTEL.CSS", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b8c480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.VSL", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd5800, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50bfe8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5cd5800, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIPELINE.VRD", cAlternateFileName="")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xdf0d2c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x33a380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJINTL.DLL", cAlternateFileName="")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJINTLC.DLL", cAlternateFileName="")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c24a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMENURES.DLL", cAlternateFileName="")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4cf264, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV.HXS", cAlternateFileName="POWERP~1.HXS")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXC", cAlternateFileName="POWERP~1.HXC")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXT", cAlternateFileName="POWERP~1.HXT")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_F_COL.HXK", cAlternateFileName="POWERP~1.HXK")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_K_COL.HXK", cAlternateFileName="POWERP~2.HXK")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x68013d, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.HXS", cAlternateFileName="")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC", cAlternateFileName="POWERP~2.HXC")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT", cAlternateFileName="POWERP~2.HXT")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK", cAlternateFileName="POWERP~3.HXK")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK", cAlternateFileName="POWERP~4.HXK")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x139968, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL", cAlternateFileName="")) returned 1 [0087.927] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.IDX_DLL", cAlternateFileName="PPINTL~1.IDX")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x22180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.IDX_DLL", cAlternateFileName="PPINTL~2.IDX")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50c4ab60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRIMARY.CSS", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x21788, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSL", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e830b00, ftCreationTime.dwHighDateTime=0x1ca4730, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e830b00, ftLastWriteTime.dwHighDateTime=0x1ca4730, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSS", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4722d700, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4722d700, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.DOC", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.PPT", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51dd6c00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x51dd6c00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.XLS", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f1aa00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45f1aa00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.DOC", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.PPT", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d18b800, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d18b800, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.XLS", cAlternateFileName="")) returned 1 [0088.075] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e7da00, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99e7da00, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHKEY.DAT", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLEX.DAT", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLTS.DAT", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHPHN.DAT", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b190700, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b190700, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHSRN.DAT", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6a8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x10980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.IDX_DLL", cAlternateFileName="PUB6IN~1.IDX")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x41b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.IDX_DLL", cAlternateFileName="PUB6IN~2.IDX")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf925f00, ftLastWriteTime.dwHighDateTime=0x1c92dac, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM", cAlternateFileName="")) returned 1 [0088.076] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBFTSCM", cAlternateFileName="")) returned 1 [0088.076] GetProcessHeap () returned 0x840000 [0088.076] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.078] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.080] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.081] GetProcessHeap () returned 0x840000 [0088.081] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.081] GetProcessHeap () returned 0x840000 [0088.081] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.088] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.089] GetProcessHeap () returned 0x840000 [0088.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.089] GetProcessHeap () returned 0x840000 [0088.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.091] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.092] GetProcessHeap () returned 0x840000 [0088.092] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.098] GetProcessHeap () returned 0x840000 [0088.098] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.099] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.099] GetProcessHeap () returned 0x840000 [0088.099] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.100] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.100] GetProcessHeap () returned 0x840000 [0088.100] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.100] GetProcessHeap () returned 0x840000 [0088.100] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.101] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.101] GetProcessHeap () returned 0x840000 [0088.101] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.101] GetProcessHeap () returned 0x840000 [0088.101] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.102] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.102] GetProcessHeap () returned 0x840000 [0088.102] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.102] GetProcessHeap () returned 0x840000 [0088.102] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.103] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.103] GetProcessHeap () returned 0x840000 [0088.103] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.103] GetProcessHeap () returned 0x840000 [0088.103] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.105] SetEvent (hEvent=0x158) returned 1 [0088.105] ResetEvent (hEvent=0x15c) returned 1 [0088.105] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE", cAlternateFileName="ACWZMA~1.ACC")) returned 1 [0088.105] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE", cAlternateFileName="ACWZTO~1.ACC")) returned 1 [0088.105] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU", cAlternateFileName="ACWZUS~1.ACC")) returned 1 [0088.106] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 1 [0088.106] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 0 [0088.106] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.106] GetProcessHeap () returned 0x840000 [0088.106] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.106] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0088.107] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0088.107] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0088.107] GetProcessHeap () returned 0x840000 [0088.107] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.109] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.109] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0088.109] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0088.110] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0088.110] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.111] GetProcessHeap () returned 0x840000 [0088.111] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0088.111] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0088.112] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0088.113] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0088.113] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0088.113] GetProcessHeap () returned 0x840000 [0088.113] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.131] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0088.132] GetProcessHeap () returned 0x840000 [0088.132] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.132] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL", cAlternateFileName="")) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TITLE.XSL", cAlternateFileName="")) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 0 [0088.132] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.132] GetProcessHeap () returned 0x840000 [0088.132] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0088.133] GetProcessHeap () returned 0x840000 [0088.133] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24a63000, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x5282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25ddce00, ftLastWriteTime.dwHighDateTime=0x1c93006, nFileSizeHigh=0x0, nFileSizeLow=0x40188, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe44d2300, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3cd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x828cb900, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3b9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd7dc00, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x4033d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a982900, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x3ee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e2f9800, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x49051, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLA.XSL", cAlternateFileName="")) returned 1 [0088.146] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2fb63100, ftLastWriteTime.dwHighDateTime=0x1c6da3c, nFileSizeHigh=0x0, nFileSizeLow=0x3bd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0088.146] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0088.146] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0088.146] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.146] GetProcessHeap () returned 0x840000 [0088.146] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.146] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0088.147] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.147] GetProcessHeap () returned 0x840000 [0088.147] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.147] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0088.147] GetProcessHeap () returned 0x840000 [0088.147] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.273] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.273] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0088.273] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0088.273] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 0 [0088.274] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.275] GetProcessHeap () returned 0x840000 [0088.275] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.275] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0088.276] GetProcessHeap () returned 0x840000 [0088.276] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.293] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.293] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0088.293] GetProcessHeap () returned 0x840000 [0088.293] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMR.FAE", cAlternateFileName="")) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCALDV.DLL", cAlternateFileName="")) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCR.SAM", cAlternateFileName="")) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x35b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADDR.FAE", cAlternateFileName="")) returned 1 [0088.295] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf79ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPTR.FAE", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1332250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNLR.FAE", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAILR.FAE", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x25b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTER.FAE", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLR.SAM", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASKR.FAE", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x31a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97R.SAM", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PABR.SAM", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 1 [0088.296] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 0 [0088.296] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.297] GetProcessHeap () returned 0x840000 [0088.297] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0088.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMDOS.FAE", cAlternateFileName="")) returned 1 [0088.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0088.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKSAM.SAM", cAlternateFileName="")) returned 1 [0088.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC.SAM", cAlternateFileName="")) returned 1 [0088.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OL.SAM", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADD.FAE", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPT.FAE", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNL.FAE", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAIL.FAE", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTE.FAE", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAB.SAM", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x18568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RM.DLL", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 0 [0088.298] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.298] GetProcessHeap () returned 0x840000 [0088.298] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.298] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0088.299] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0088.299] GetProcessHeap () returned 0x840000 [0088.299] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.337] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.337] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0088.337] GetProcessHeap () returned 0x840000 [0088.338] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.338] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.338] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0088.338] GetProcessHeap () returned 0x840000 [0088.338] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0088.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0088.339] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.339] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0088.339] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0088.339] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0088.339] GetProcessHeap () returned 0x840000 [0088.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0088.339] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0088.339] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.339] GetProcessHeap () returned 0x840000 [0088.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.339] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0088.339] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.339] GetProcessHeap () returned 0x840000 [0088.339] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0088.341] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0088.342] GetProcessHeap () returned 0x840000 [0088.342] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.343] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.346] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0088.351] GetProcessHeap () returned 0x840000 [0088.351] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.406] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.406] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0088.406] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITS.ICO", cAlternateFileName="")) returned 1 [0088.406] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITY.CFG", cAlternateFileName="")) returned 1 [0088.406] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPT.CFG", cAlternateFileName="")) returned 1 [0088.406] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTL.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTS.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.CFG", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8ed400, ftCreationTime.dwHighDateTime=0x1c68837, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec8ed400, ftLastWriteTime.dwHighDateTime=0x1c68837, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFRES.CFG", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONFLICT.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.CFG", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTL.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTS.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLIST.CFG", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTL.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTS.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOC.CFG", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCL.ICO", cAlternateFileName="")) returned 1 [0088.407] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCS.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e9c00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x473e9c00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEM.CFG", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEML.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEMS.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb999900, ftCreationTime.dwHighDateTime=0x1c451be, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb999900, ftLastWriteTime.dwHighDateTime=0x1c451be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMAIL.CFG", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0fd900, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d0fd900, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOML.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1839500, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1839500, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMS.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPM.CFG", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPML.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPMS.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97071d00, ftCreationTime.dwHighDateTime=0x1c67f43, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97071d00, ftLastWriteTime.dwHighDateTime=0x1c67f43, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSL.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7feec00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7feec00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSS.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTE.CFG", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEL.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTES.ICO", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d2200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x142d2200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMMS.CFG", cAlternateFileName="")) returned 1 [0088.408] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273ff200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x273ff200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSSMS.CFG", cAlternateFileName="")) returned 1 [0088.411] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFL.ICO", cAlternateFileName="")) returned 1 [0088.411] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFS.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4466a600, ftCreationTime.dwHighDateTime=0x1c9449a, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4466a600, ftLastWriteTime.dwHighDateTime=0x1c9449a, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFTMPL.CFG", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fb15d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST.CFG", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTIT.CFG", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITL.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITS.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTL.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTS.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="RCLRPT.CFG", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x651, dwReserved0=0x0, dwReserved1=0x0, cFileName="REC.CFG", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECL.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECS.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTE.CFG", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTEL.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTES.ICO", cAlternateFileName="")) returned 1 [0088.412] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPLTMPL.CFG", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.CFG", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTL.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTS.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESEND.CFG", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDL.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDS.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f7400, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x216f7400, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEM.CFG", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecff500, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ecff500, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEML.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081d900, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3081d900, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEMS.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLL.ICO", cAlternateFileName="")) returned 1 [0088.413] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLS.ICO", cAlternateFileName="")) returned 1 [0088.415] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0088.416] GetProcessHeap () returned 0x840000 [0088.416] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0088.416] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0088.416] GetProcessHeap () returned 0x840000 [0088.416] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0088.416] GetProcessHeap () returned 0x840000 [0088.417] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0088.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0088.515] GetProcessHeap () returned 0x840000 [0088.515] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0088.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0088.593] GetProcessHeap () returned 0x840000 [0088.593] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0088.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0088.672] GetProcessHeap () returned 0x840000 [0088.672] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0088.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0088.721] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0088.722] GetProcessHeap () returned 0x840000 [0088.722] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0088.722] GetProcessHeap () returned 0x840000 [0088.722] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0088.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0088.811] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0088.812] GetProcessHeap () returned 0x840000 [0088.812] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0088.812] GetProcessHeap () returned 0x840000 [0088.812] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0088.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0088.812] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0088.812] GetProcessHeap () returned 0x840000 [0088.812] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0088.812] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0088.812] GetProcessHeap () returned 0x840000 [0088.812] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0088.812] GetProcessHeap () returned 0x840000 [0088.812] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0088.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0088.953] GetProcessHeap () returned 0x840000 [0088.953] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0088.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.096] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.097] GetProcessHeap () returned 0x840000 [0089.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.097] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0089.097] GetProcessHeap () returned 0x840000 [0089.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0089.097] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0089.097] GetProcessHeap () returned 0x840000 [0089.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0089.097] GetProcessHeap () returned 0x840000 [0089.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0089.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0089.171] GetProcessHeap () returned 0x840000 [0089.171] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0089.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0089.173] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0089.173] GetProcessHeap () returned 0x840000 [0089.173] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0089.173] GetProcessHeap () returned 0x840000 [0089.174] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0089.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0089.175] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0089.176] GetProcessHeap () returned 0x840000 [0089.176] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0089.176] GetProcessHeap () returned 0x840000 [0089.176] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0089.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0089.178] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0089.179] GetProcessHeap () returned 0x840000 [0089.179] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0089.179] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0089.179] GetProcessHeap () returned 0x840000 [0089.179] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0089.179] GetProcessHeap () returned 0x840000 [0089.179] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0089.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0089.184] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0089.185] GetProcessHeap () returned 0x840000 [0089.185] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0089.185] GetProcessHeap () returned 0x840000 [0089.185] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0089.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0089.186] GetProcessHeap () returned 0x840000 [0089.186] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0089.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0089.187] GetProcessHeap () returned 0x840000 [0089.188] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.192] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.193] GetProcessHeap () returned 0x840000 [0089.193] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.193] GetProcessHeap () returned 0x840000 [0089.193] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.195] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.196] GetProcessHeap () returned 0x840000 [0089.196] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.196] GetProcessHeap () returned 0x840000 [0089.196] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.196] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.196] GetProcessHeap () returned 0x840000 [0089.196] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.196] GetProcessHeap () returned 0x840000 [0089.196] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.197] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.197] GetProcessHeap () returned 0x840000 [0089.197] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.197] GetProcessHeap () returned 0x840000 [0089.197] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.198] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.198] GetProcessHeap () returned 0x840000 [0089.198] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.198] GetProcessHeap () returned 0x840000 [0089.198] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.200] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.200] GetProcessHeap () returned 0x840000 [0089.200] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.200] GetProcessHeap () returned 0x840000 [0089.200] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.364] GetProcessHeap () returned 0x840000 [0089.364] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0089.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0089.366] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0089.367] GetProcessHeap () returned 0x840000 [0089.367] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0089.367] GetProcessHeap () returned 0x840000 [0089.367] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0089.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0089.370] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0089.370] GetProcessHeap () returned 0x840000 [0089.370] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0089.370] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.370] GetProcessHeap () returned 0x840000 [0089.370] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.370] GetProcessHeap () returned 0x840000 [0089.371] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.375] GetProcessHeap () returned 0x840000 [0089.375] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0089.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0089.377] GetProcessHeap () returned 0x840000 [0089.377] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.378] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.378] GetProcessHeap () returned 0x840000 [0089.378] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.378] GetProcessHeap () returned 0x840000 [0089.378] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.378] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.378] GetProcessHeap () returned 0x840000 [0089.378] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.378] GetProcessHeap () returned 0x840000 [0089.378] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.379] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.379] GetProcessHeap () returned 0x840000 [0089.379] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.379] GetProcessHeap () returned 0x840000 [0089.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.380] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.380] GetProcessHeap () returned 0x840000 [0089.380] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.380] GetProcessHeap () returned 0x840000 [0089.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.381] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.381] GetProcessHeap () returned 0x840000 [0089.381] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.381] GetProcessHeap () returned 0x840000 [0089.381] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.382] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.382] GetProcessHeap () returned 0x840000 [0089.382] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.382] GetProcessHeap () returned 0x840000 [0089.382] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.382] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.382] GetProcessHeap () returned 0x840000 [0089.382] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.382] GetProcessHeap () returned 0x840000 [0089.382] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.383] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.383] GetProcessHeap () returned 0x840000 [0089.383] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.383] GetProcessHeap () returned 0x840000 [0089.383] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.383] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.383] GetProcessHeap () returned 0x840000 [0089.383] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.383] GetProcessHeap () returned 0x840000 [0089.383] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.384] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.384] GetProcessHeap () returned 0x840000 [0089.384] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.384] GetProcessHeap () returned 0x840000 [0089.384] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.385] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.385] GetProcessHeap () returned 0x840000 [0089.385] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.385] GetProcessHeap () returned 0x840000 [0089.385] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.387] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.387] GetProcessHeap () returned 0x840000 [0089.387] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.387] GetProcessHeap () returned 0x840000 [0089.387] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.388] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.388] GetProcessHeap () returned 0x840000 [0089.388] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.389] GetProcessHeap () returned 0x840000 [0089.389] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.389] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.389] GetProcessHeap () returned 0x840000 [0089.389] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.389] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0089.389] GetProcessHeap () returned 0x840000 [0089.389] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0089.389] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.389] GetProcessHeap () returned 0x840000 [0089.389] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.389] GetProcessHeap () returned 0x840000 [0089.389] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0089.395] GetProcessHeap () returned 0x840000 [0089.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0089.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0089.398] GetProcessHeap () returned 0x840000 [0089.398] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.398] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.398] GetProcessHeap () returned 0x840000 [0089.398] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.398] GetProcessHeap () returned 0x840000 [0089.398] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.399] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.399] GetProcessHeap () returned 0x840000 [0089.399] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.399] GetProcessHeap () returned 0x840000 [0089.399] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.400] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.400] GetProcessHeap () returned 0x840000 [0089.400] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.400] GetProcessHeap () returned 0x840000 [0089.400] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.401] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.401] GetProcessHeap () returned 0x840000 [0089.401] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.401] GetProcessHeap () returned 0x840000 [0089.401] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.402] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.402] GetProcessHeap () returned 0x840000 [0089.402] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.402] GetProcessHeap () returned 0x840000 [0089.402] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.402] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.403] GetProcessHeap () returned 0x840000 [0089.403] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.403] GetProcessHeap () returned 0x840000 [0089.403] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.403] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.403] GetProcessHeap () returned 0x840000 [0089.403] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.403] GetProcessHeap () returned 0x840000 [0089.404] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.405] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.405] GetProcessHeap () returned 0x840000 [0089.405] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.405] GetProcessHeap () returned 0x840000 [0089.405] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.576] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.576] GetProcessHeap () returned 0x840000 [0089.576] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.576] GetProcessHeap () returned 0x840000 [0089.576] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.672] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.672] GetProcessHeap () returned 0x840000 [0089.672] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.672] GetProcessHeap () returned 0x840000 [0089.672] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.672] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.672] GetProcessHeap () returned 0x840000 [0089.672] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.672] GetProcessHeap () returned 0x840000 [0089.672] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.744] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.744] GetProcessHeap () returned 0x840000 [0089.744] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.744] GetProcessHeap () returned 0x840000 [0089.744] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.858] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.858] GetProcessHeap () returned 0x840000 [0089.858] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.858] GetProcessHeap () returned 0x840000 [0089.858] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0089.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0089.942] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0089.942] GetProcessHeap () returned 0x840000 [0089.942] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0089.942] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0089.942] GetProcessHeap () returned 0x840000 [0089.942] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0089.942] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0089.942] GetProcessHeap () returned 0x840000 [0089.942] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0089.942] GetProcessHeap () returned 0x840000 [0089.942] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0089.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0090.213] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0090.214] GetProcessHeap () returned 0x840000 [0090.214] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0090.214] GetProcessHeap () returned 0x840000 [0090.214] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0090.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0090.282] GetProcessHeap () returned 0x840000 [0090.282] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0090.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0090.325] GetProcessHeap () returned 0x840000 [0090.325] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0090.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0090.325] GetProcessHeap () returned 0x840000 [0090.325] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32b0068 [0090.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", lpFindFileData=0x289dbe0 | out: lpFindFileData=0x289dbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d98 [0090.329] FindClose (in: hFindFile=0x937d98 | out: hFindFile=0x937d98) returned 1 [0090.329] GetProcessHeap () returned 0x840000 [0090.329] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32b0068 | out: hHeap=0x840000) returned 1 [0090.329] GetProcessHeap () returned 0x840000 [0090.329] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32b0068 [0090.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", lpFindFileData=0x289dbe0 | out: lpFindFileData=0x289dbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d98 [0090.330] FindClose (in: hFindFile=0x937d98 | out: hFindFile=0x937d98) returned 1 [0090.331] GetProcessHeap () returned 0x840000 [0090.331] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32b0068 | out: hHeap=0x840000) returned 1 [0090.331] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0090.331] GetProcessHeap () returned 0x840000 [0090.331] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0090.331] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0090.331] GetProcessHeap () returned 0x840000 [0090.331] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0090.331] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0090.332] GetProcessHeap () returned 0x840000 [0090.332] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0090.332] GetProcessHeap () returned 0x840000 [0090.332] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0090.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0090.332] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0090.332] GetProcessHeap () returned 0x840000 [0090.333] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0090.333] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0090.333] GetProcessHeap () returned 0x840000 [0090.333] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0090.333] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.333] GetProcessHeap () returned 0x840000 [0090.333] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.334] GetProcessHeap () returned 0x840000 [0090.334] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.337] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.338] GetProcessHeap () returned 0x840000 [0090.338] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.338] GetProcessHeap () returned 0x840000 [0090.338] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.339] GetProcessHeap () returned 0x840000 [0090.339] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0090.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0090.341] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0090.341] GetProcessHeap () returned 0x840000 [0090.341] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0090.341] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.341] GetProcessHeap () returned 0x840000 [0090.341] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.342] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.342] GetProcessHeap () returned 0x840000 [0090.342] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.342] GetProcessHeap () returned 0x840000 [0090.342] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.484] GetProcessHeap () returned 0x840000 [0090.484] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.684] GetProcessHeap () returned 0x840000 [0090.684] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0090.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0090.685] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0090.686] GetProcessHeap () returned 0x840000 [0090.686] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0090.686] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.686] GetProcessHeap () returned 0x840000 [0090.686] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.687] GetProcessHeap () returned 0x840000 [0090.687] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.687] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.687] GetProcessHeap () returned 0x840000 [0090.688] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.688] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.688] GetProcessHeap () returned 0x840000 [0090.688] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.688] GetProcessHeap () returned 0x840000 [0090.688] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.688] GetProcessHeap () returned 0x840000 [0090.688] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.692] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.693] GetProcessHeap () returned 0x840000 [0090.693] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.693] GetProcessHeap () returned 0x840000 [0090.693] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.693] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.693] GetProcessHeap () returned 0x840000 [0090.693] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.694] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.694] GetProcessHeap () returned 0x840000 [0090.694] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.698] GetProcessHeap () returned 0x840000 [0090.698] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.701] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.702] GetProcessHeap () returned 0x840000 [0090.702] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.707] GetProcessHeap () returned 0x840000 [0090.707] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.709] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.710] GetProcessHeap () returned 0x840000 [0090.710] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.710] GetProcessHeap () returned 0x840000 [0090.710] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.713] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.714] GetProcessHeap () returned 0x840000 [0090.714] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.714] GetProcessHeap () returned 0x840000 [0090.714] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.717] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.717] GetProcessHeap () returned 0x840000 [0090.718] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.718] GetProcessHeap () returned 0x840000 [0090.718] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0090.859] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.859] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0090.859] GetProcessHeap () returned 0x840000 [0090.859] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.930] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.930] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0090.930] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 0 [0090.930] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.930] GetProcessHeap () returned 0x840000 [0090.931] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.931] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0090.931] GetProcessHeap () returned 0x840000 [0090.931] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.931] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.931] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0090.931] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 0 [0090.931] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.931] GetProcessHeap () returned 0x840000 [0090.931] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.931] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0090.931] GetProcessHeap () returned 0x840000 [0090.931] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0090.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0090.931] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.932] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0090.932] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 0 [0090.932] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0090.932] GetProcessHeap () returned 0x840000 [0090.932] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade5d100, ftCreationTime.dwHighDateTime=0x1c04525, ftLastAccessTime.dwLowDateTime=0x59b6e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xade5d100, ftLastWriteTime.dwHighDateTime=0x1c04525, nFileSizeHigh=0x0, nFileSizeLow=0x4112e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.LEX", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373ef00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xa459d340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x373ef00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.LEX", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4343d200, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa206bb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4343d200, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7EN.DLL", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14732f00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2091ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x14732f00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x74200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7EN.LEX", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccd3a00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6e3aaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4ccd3a00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7ES.DLL", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d58900, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e3aaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x16d58900, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7ES.LEX", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa45c34a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7FR.DLL", cAlternateFileName="")) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14732f00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45c34a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x14732f00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x43e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7FR.LEX", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa20ddfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.DLL", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2c5600, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa22cd180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e2c5600, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.dub", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2980600, ftCreationTime.dwHighDateTime=0x1cbae31, ftLastAccessTime.dwLowDateTime=0xa2091ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd2980600, ftLastWriteTime.dwHighDateTime=0x1cbae31, nFileSizeHigh=0x0, nFileSizeLow=0x145e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.LEX", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4aef00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa6ed3020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f4aef00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.DLL", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.dub", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e60c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1e0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.LEX", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e19c200, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa471a100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e19c200, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.DLL", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bfdd00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa4c28fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x41bfdd00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.dub", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f10a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45e9600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x42f10a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1b1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.LEX", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa2176520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7EN.DLL", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa395100, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa21503c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfa395100, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0x40de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7EN.LEX", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7ES.DLL", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2918c00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6f45440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2918c00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x5b3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7ES.LEX", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4824aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.DLL", cAlternateFileName="")) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6a7e00, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa47fe940, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfb6a7e00, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0xc6aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.LEX", cAlternateFileName="")) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6a7e00, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa47fe940, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfb6a7e00, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0xc6aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.LEX", cAlternateFileName="")) returned 0 [0090.935] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0090.935] GetProcessHeap () returned 0x840000 [0090.935] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65b7600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x130b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.DLL", cAlternateFileName="")) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRTF9.DLL", cAlternateFileName="")) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x68368, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSTPRX32.DLL", cAlternateFileName="")) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTXT9.DLL", cAlternateFileName="")) returned 1 [0090.935] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBBA", cAlternateFileName="")) returned 1 [0090.935] GetProcessHeap () returned 0x840000 [0090.935] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0090.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.061] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.061] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0091.061] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x69e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB11.BDR", cAlternateFileName="")) returned 1 [0091.061] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xf254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB1A.BDR", cAlternateFileName="")) returned 1 [0091.061] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB1B.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xc8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB2A.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB2B.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xde58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB3A.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xf4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB3B.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xc144, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB4.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xcfb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5A.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x2476, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5B.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x7f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB6.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x799a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB7.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB8.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x6bbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB9.BDR", cAlternateFileName="")) returned 1 [0091.062] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x6bbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB9.BDR", cAlternateFileName="")) returned 0 [0091.062] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.063] GetProcessHeap () returned 0x840000 [0091.063] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.064] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0091.064] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe778, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBTRAP.DLL", cAlternateFileName="")) returned 1 [0091.064] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWIZ", cAlternateFileName="")) returned 1 [0091.064] GetProcessHeap () returned 0x840000 [0091.064] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.106] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x1cba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCTBOX.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x5f09, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD.DPV", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52fa4f00, ftCreationTime.dwHighDateTime=0x1c917c2, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52fa4f00, ftLastWriteTime.dwHighDateTime=0x1c917c2, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD.XML", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xb95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD98.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADRESPEL.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x594c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR98.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa402, dwReserved0=0x0, dwReserved1=0x0, cFileName="AWARDHM.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x91cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAN98.POC", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xd2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.DPV", cAlternateFileName="")) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd27b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fd27b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x236c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.XML", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x4d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDRTKFUL.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x3f40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.DPV", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cde200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47cde200, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x31ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.XML", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d76700, ftCreationTime.dwHighDateTime=0x1c5ee67, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d76700, ftLastWriteTime.dwHighDateTime=0x1c5ee67, nFileSizeHigh=0x0, nFileSizeLow=0x1b7ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.DPV", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x397fc500, ftCreationTime.dwHighDateTime=0x1ca5c59, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x397fc500, ftLastWriteTime.dwHighDateTime=0x1ca5c59, nFileSizeHigh=0x0, nFileSizeLow=0x10a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.XML", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e02aa00, ftCreationTime.dwHighDateTime=0x1c9c882, ftLastAccessTime.dwLowDateTime=0x51a3b970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e02aa00, ftLastWriteTime.dwHighDateTime=0x1c9c882, nFileSizeHigh=0x0, nFileSizeLow=0xf0ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.DPV", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ef0c00, ftCreationTime.dwHighDateTime=0x1c97a03, ftLastAccessTime.dwLowDateTime=0x5fff0470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ef0c00, ftLastWriteTime.dwHighDateTime=0x1c97a03, nFileSizeHigh=0x0, nFileSizeLow=0x4e42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd88300, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600165d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd88300, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3f046, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCH98SP.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba931800, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba931800, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x98f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR11.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x243f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR98.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bfe5500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfe5500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xa7190, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.DPV", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181eda00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x181eda00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x757a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.XML", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS2BARB.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51ad3ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS4BOXES.POC", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS53BOXS.POC", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x12c2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARD11.POC", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xe6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARDHM.POC", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x6214, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCD98SP.POC", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde565e00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde565e00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3caa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCRD98.POC", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b8ea00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36b8ea00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x148f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.DPV", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f308b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f308b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x2614, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.XML", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9e500, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9e500, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x329e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALHM.POC", cAlternateFileName="")) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x940b200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c049f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x940b200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1a6da2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALNDR98.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd43900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60251a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd43900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1b8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALSO11.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178ece00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60251a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x178ece00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x696d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALSO98.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d74700, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24d74700, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x4e4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATALOG.DPV", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6579900, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x6035c410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6579900, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATALOG.XML", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c538200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6035c410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c538200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x62f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATWIZ.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x24f44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATWIZ11.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b44000, ftCreationTime.dwHighDateTime=0x1c65228, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73b44000, ftLastWriteTime.dwHighDateTime=0x1c65228, nFileSizeHigh=0x0, nFileSizeLow=0x2c1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT.DPV", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1122e00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1122e00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x170a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT.XML", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x11b82, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT98.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x53bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT98SP.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x170e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHECKER.POC", cAlternateFileName="")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932e9200, ftCreationTime.dwHighDateTime=0x1c9c700, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x932e9200, ftLastWriteTime.dwHighDateTime=0x1c9c700, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTINFOBB.DPV", cAlternateFileName="CONTAC~1.DPV")) returned 1 [0091.122] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x854dcb00, ftCreationTime.dwHighDateTime=0x1c9c314, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x854dcb00, ftLastWriteTime.dwHighDateTime=0x1c9c314, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTINFOBB.POC", cAlternateFileName="CONTAC~1.POC")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xc692, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUPON.POC", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff04000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ff04000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBAR.DPV", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBAR.XML", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf1300, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ebf1300, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBOX.DPV", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6027400, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6027400, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBOX.XML", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ce100, ftCreationTime.dwHighDateTime=0x1c5ffa1, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe82ce100, ftLastWriteTime.dwHighDateTime=0x1c5ffa1, nFileSizeHigh=0x0, nFileSizeLow=0x4b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGAD.DPV", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5aaf00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5aaf00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGAD.XML", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc92fc900, ftCreationTime.dwHighDateTime=0x1c7e8c2, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92fc900, ftLastWriteTime.dwHighDateTime=0x1c7e8c2, nFileSizeHigh=0x0, nFileSizeLow=0x5269, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGATNGET.DPV", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b2ea00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b2ea00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGATNGET.XML", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBARBLL.DPV", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBARBLL.XML", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBORDER.DPV", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9924200, ftCreationTime.dwHighDateTime=0x1c9a14d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9924200, ftLastWriteTime.dwHighDateTime=0x1c9a14d, nFileSizeHigh=0x0, nFileSizeLow=0x9a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBORDER.XML", cAlternateFileName="")) returned 1 [0091.123] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBOXES.DPV", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x321df500, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x321df500, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBOXES.XML", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1497e200, ftCreationTime.dwHighDateTime=0x1c6856f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1497e200, ftLastWriteTime.dwHighDateTime=0x1c6856f, nFileSizeHigh=0x0, nFileSizeLow=0x35468, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.DPV", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75d00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba75d00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.XML", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca59dd00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca59dd00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.DPV", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.XML", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147eee00, ftCreationTime.dwHighDateTime=0x1c9c48f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x147eee00, ftLastWriteTime.dwHighDateTime=0x1c9c48f, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCINFO.XML", cAlternateFileName="")) returned 1 [0091.124] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4caf000, ftCreationTime.dwHighDateTime=0x1c5e8f4, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4caf000, ftLastWriteTime.dwHighDateTime=0x1c5e8f4, nFileSizeHigh=0x0, nFileSizeLow=0x6082, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCOUPON.DPV", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57d300, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c57d300, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCOUPON.XML", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8274200, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8274200, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGDOTS.DPV", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d44000, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d44000, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGDOTS.XML", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38629c00, ftCreationTime.dwHighDateTime=0x1ca08e5, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38629c00, ftLastWriteTime.dwHighDateTime=0x1ca08e5, nFileSizeHigh=0x0, nFileSizeLow=0x1ba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGHEADING.XML", cAlternateFileName="DGHEAD~1.XML")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8274200, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8274200, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLINACC.DPV", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22c7b00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa22c7b00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLINACC.XML", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e5000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef4e5000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLOGO.DPV", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa84b600, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa84b600, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x7ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLOGO.XML", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d1c200, ftCreationTime.dwHighDateTime=0x1ca579b, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0d1c200, ftLastWriteTime.dwHighDateTime=0x1ca579b, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMAIN.XML", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e5000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef4e5000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMARQ.DPV", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba03ff00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba03ff00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMARQ.XML", cAlternateFileName="")) returned 1 [0091.152] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e00d500, ftCreationTime.dwHighDateTime=0x1c7e8c8, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e00d500, ftLastWriteTime.dwHighDateTime=0x1c7e8c8, nFileSizeHigh=0x0, nFileSizeLow=0x50f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMASTHD.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c37b00, ftCreationTime.dwHighDateTime=0x1c6272e, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8c37b00, ftLastWriteTime.dwHighDateTime=0x1c6272e, nFileSizeHigh=0x0, nFileSizeLow=0x71a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGNAVBAR.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc98600, ftCreationTime.dwHighDateTime=0x1c94493, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fc98600, ftLastWriteTime.dwHighDateTime=0x1c94493, nFileSizeHigh=0x0, nFileSizeLow=0x11c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGNAVBAR.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb8e7500, ftCreationTime.dwHighDateTime=0x1c9a6a9, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb8e7500, ftLastWriteTime.dwHighDateTime=0x1c9a6a9, nFileSizeHigh=0x0, nFileSizeLow=0x1eeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPICCAP.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb78a5e00, ftCreationTime.dwHighDateTime=0x1c9a6c0, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb78a5e00, ftLastWriteTime.dwHighDateTime=0x1c9a6c0, nFileSizeHigh=0x0, nFileSizeLow=0x1aca, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPICCAP.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e97a00, ftCreationTime.dwHighDateTime=0x1c7e417, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36e97a00, ftLastWriteTime.dwHighDateTime=0x1c7e417, nFileSizeHigh=0x0, nFileSizeLow=0x938f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPQUOT.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3150300, ftCreationTime.dwHighDateTime=0x1c97a05, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3150300, ftLastWriteTime.dwHighDateTime=0x1c97a05, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPQUOT.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b69d100, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b69d100, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPUNCT.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5039ff00, ftCreationTime.dwHighDateTime=0x1c9c865, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5039ff00, ftLastWriteTime.dwHighDateTime=0x1c9c865, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPUNCT.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2465f500, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2465f500, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0x6e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGREPFRM.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cff600, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6cff600, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGREPFRM.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6bca00, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b6bca00, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0xae41, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBR.DPV", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d1d600, ftCreationTime.dwHighDateTime=0x1c976eb, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2d1d600, ftLastWriteTime.dwHighDateTime=0x1c976eb, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBR.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109f3b00, ftCreationTime.dwHighDateTime=0x1c976ec, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x109f3b00, ftLastWriteTime.dwHighDateTime=0x1c976ec, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBRV.XML", cAlternateFileName="DGSIDE~1.XML")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd73700, ftCreationTime.dwHighDateTime=0x1c976e8, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdd73700, ftLastWriteTime.dwHighDateTime=0x1c976e8, nFileSizeHigh=0x0, nFileSizeLow=0xb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSTORY.XML", cAlternateFileName="")) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f7200, ftCreationTime.dwHighDateTime=0x1c976e9, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62f7200, ftLastWriteTime.dwHighDateTime=0x1c976e9, nFileSizeHigh=0x0, nFileSizeLow=0xb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSTORYVERT.XML", cAlternateFileName="DGSTOR~1.XML")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573f000, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573f000, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTEAR.DPV", cAlternateFileName="")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0dd700, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0dd700, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0xe50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTOC.DPV", cAlternateFileName="")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd764d00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd764d00, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1712, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTOC.XML", cAlternateFileName="")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149d5b00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x149d5b00, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBAD.XML", cAlternateFileName="")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaad500, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aaad500, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBBTN.DPV", cAlternateFileName="")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf59600, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cf59600, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x110e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBBTN.XML", cAlternateFileName="")) returned 1 [0091.154] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af16e00, ftCreationTime.dwHighDateTime=0x1c6856e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af16e00, ftLastWriteTime.dwHighDateTime=0x1c6856e, nFileSizeHigh=0x0, nFileSizeLow=0x301be, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBCAL.DPV", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22eb7700, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22eb7700, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBCAL.XML", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4317bc00, ftCreationTime.dwHighDateTime=0x1c68573, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4317bc00, ftLastWriteTime.dwHighDateTime=0x1c68573, nFileSizeHigh=0x0, nFileSizeLow=0x2f814, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBHD.DPV", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a128500, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a128500, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1dbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBHD.XML", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438bc800, ftCreationTime.dwHighDateTime=0x1c6157c, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x438bc800, ftLastWriteTime.dwHighDateTime=0x1c6157c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBPQT.DPV", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326ac000, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x326ac000, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBPQT.XML", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67294800, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67294800, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBREF.XML", cAlternateFileName="")) returned 1 [0091.155] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4495b400, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4495b400, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0x6df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBSBR.DPV", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a9ff00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57a9ff00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBSBR.XML", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d4dc00, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36d4dc00, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGZIP.DPV", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8d1000, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8d1000, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGZIPC.XML", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTS.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21183600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21183600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x10c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDHM.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x7dc55, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL.DPV", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8393c00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8393c00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xd066, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL.XML", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2aa19e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xbc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL11.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcdd400, ftCreationTime.dwHighDateTime=0x1c513d0, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadcdd400, ftLastWriteTime.dwHighDateTime=0x1c513d0, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAILMOD.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2aa19e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xc5fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV11.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2a052, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV98.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x4af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV98SP.POC", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1cb200, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1cb200, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x24efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DPV", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df38200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6df38200, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x30de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.XML", cAlternateFileName="")) returned 1 [0091.156] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x8a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVHM.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="FEZIP.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e352500, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e352500, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xfd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLY98SP.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd64c00, ftCreationTime.dwHighDateTime=0x1c8f193, ftLastAccessTime.dwLowDateTime=0x52883d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3dd64c00, ftLastWriteTime.dwHighDateTime=0x1c8f193, nFileSizeHigh=0x0, nFileSizeLow=0x15369c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER.DPV", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9709c00, ftCreationTime.dwHighDateTime=0x1ca5799, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9709c00, ftLastWriteTime.dwHighDateTime=0x1ca5799, nFileSizeHigh=0x0, nFileSizeLow=0x13d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER.XML", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30977f00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30977f00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x369a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER11.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db46e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3db46e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xe498e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER98.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee59b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ee59b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xd988, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYERHM.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20129300, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20129300, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x56ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDPROJ.DPV", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2800, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2800, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x62c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDPROJ.XML", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x8c952, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM98.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMCTL.POC", cAlternateFileName="")) returned 1 [0091.157] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x52a00b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FS3BOX.POC", cAlternateFileName="")) returned 1 [0091.158] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1cb200, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1cb200, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xb0c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFT.DPV", cAlternateFileName="")) returned 1 [0091.158] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe454bd00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe454bd00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x14c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFT.XML", cAlternateFileName="")) returned 1 [0091.158] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad15d00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad15d00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x22cf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFT98.POC", cAlternateFileName="")) returned 1 [0091.158] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591f7900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x591f7900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xd6314, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREET11.POC", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48212100, ftCreationTime.dwHighDateTime=0x1c5dbc8, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48212100, ftLastWriteTime.dwHighDateTime=0x1c5dbc8, nFileSizeHigh=0x0, nFileSizeLow=0x124b3b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREETING.DPV", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7d700, ftCreationTime.dwHighDateTime=0x1ca5794, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe7d700, ftLastWriteTime.dwHighDateTime=0x1ca5794, nFileSizeHigh=0x0, nFileSizeLow=0xfb0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREETING.XML", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfac75100, ftCreationTime.dwHighDateTime=0x1c976be, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfac75100, ftLastWriteTime.dwHighDateTime=0x1c976be, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADINGBB.DPV", cAlternateFileName="HEADIN~1.DPV")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf392a100, ftCreationTime.dwHighDateTime=0x1c97a38, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf392a100, ftLastWriteTime.dwHighDateTime=0x1c97a38, nFileSizeHigh=0x0, nFileSizeLow=0x27e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADINGBB.POC", cAlternateFileName="HEADIN~1.POC")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376aae00, ftCreationTime.dwHighDateTime=0x1c5dbbc, ftLastAccessTime.dwLowDateTime=0x61e6fe50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376aae00, ftLastWriteTime.dwHighDateTime=0x1c5dbbc, nFileSizeHigh=0x0, nFileSizeLow=0x3cbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVITE.DPV", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc31f00, ftCreationTime.dwHighDateTime=0x1ca579a, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dc31f00, ftLastWriteTime.dwHighDateTime=0x1ca579a, nFileSizeHigh=0x0, nFileSizeLow=0x49c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVITE.XML", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a8e100, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x61e6fe50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62a8e100, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xbc448, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVITE11.POC", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db03900, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db03900, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x2a1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL.DPV", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc1b100, ftCreationTime.dwHighDateTime=0x1ca579a, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc1b100, ftLastWriteTime.dwHighDateTime=0x1ca579a, nFileSizeHigh=0x0, nFileSizeLow=0x48c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL.XML", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x27842, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL98.POC", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3464, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABELHM.POC", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee16600, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ee16600, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x1f89d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LETTHEAD.DPV", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c11df00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5680a890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c11df00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x309e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LETTHEAD.XML", cAlternateFileName="")) returned 1 [0091.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEACT.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663c6800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x663c6800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xb026, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGO98.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663c6800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5825fbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x663c6800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xa82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHD11.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x69659290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2383c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHD98.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x696cb6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHD98SP.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5825fbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x9a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHDHM.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d6ff00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88d6ff00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x2694, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIN.XML", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xe56, dwReserved0=0x0, dwReserved1=0x0, cFileName="MARQUEE.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d6c200, ftCreationTime.dwHighDateTime=0x1c61d74, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d6c200, ftLastWriteTime.dwHighDateTime=0x1c61d74, nFileSizeHigh=0x0, nFileSizeLow=0x14a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENU.DPV", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f3a00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x912f3a00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x138a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENU.XML", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c324900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c324900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENU98.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e94a300, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a2661f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e94a300, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x208fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTHED98.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc5d000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fc5d000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1da0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBAR11.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f6fd00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f6fd00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1ccde, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBARV.POC", cAlternateFileName="")) returned 1 [0091.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f6fd00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f6fd00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBRPH1.POC", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f6fd00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f6fd00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBRPH2.POC", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31f43600, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31f43600, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x9965a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS.DPV", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3389e500, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x6a3e2fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3389e500, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x4260, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS.XML", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x781e0b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x781e0b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x87d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS11.POC", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ea0200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3e2fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4ea0200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2dc320, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS98.POC", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a409110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x5166c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWSHM.POC", cAlternateFileName="")) returned 1 [0091.161] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x82e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORIG98.POC", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd08900, ftCreationTime.dwHighDateTime=0x1c9a6bb, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bd08900, ftLastWriteTime.dwHighDateTime=0x1c9a6bb, nFileSizeHigh=0x0, nFileSizeLow=0x4eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICCAP98.POC", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b3ac900, ftCreationTime.dwHighDateTime=0x1c9900f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b3ac900, ftLastWriteTime.dwHighDateTime=0x1c9900f, nFileSizeHigh=0x0, nFileSizeLow=0x1eac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICSTYLES.DPV", cAlternateFileName="PICSTY~1.DPV")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTPH.POC", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1722, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNCTUATE.POC", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a555f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xb9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST98SP.POC", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33646e00, ftCreationTime.dwHighDateTime=0x1c66432, ftLastAccessTime.dwLowDateTime=0x5a57c070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33646e00, ftLastWriteTime.dwHighDateTime=0x1c66432, nFileSizeHigh=0x0, nFileSizeLow=0xa194b, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCARD.DPV", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dea000, ftCreationTime.dwHighDateTime=0x1ca579a, ftLastAccessTime.dwLowDateTime=0x5a57c070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9dea000, ftLastWriteTime.dwHighDateTime=0x1ca579a, nFileSizeHigh=0x0, nFileSizeLow=0x9a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCARD.XML", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbadfe300, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbadfe300, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCD11.POC", cAlternateFileName="")) returned 1 [0091.162] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4694b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a57c070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4694b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xa84e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCD98.POC", cAlternateFileName="")) returned 1 [0091.165] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.166] GetProcessHeap () returned 0x840000 [0091.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.166] GetProcessHeap () returned 0x840000 [0091.166] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.168] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.169] GetProcessHeap () returned 0x840000 [0091.169] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.169] GetProcessHeap () returned 0x840000 [0091.169] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.170] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.170] GetProcessHeap () returned 0x840000 [0091.170] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.171] GetProcessHeap () returned 0x840000 [0091.171] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.171] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.172] GetProcessHeap () returned 0x840000 [0091.172] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.172] GetProcessHeap () returned 0x840000 [0091.172] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.173] GetProcessHeap () returned 0x840000 [0091.173] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.699] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.701] GetProcessHeap () returned 0x840000 [0091.701] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.701] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.701] GetProcessHeap () returned 0x840000 [0091.701] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.701] GetProcessHeap () returned 0x840000 [0091.701] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.701] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.701] GetProcessHeap () returned 0x840000 [0091.701] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.701] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.702] GetProcessHeap () returned 0x840000 [0091.702] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.702] GetProcessHeap () returned 0x840000 [0091.702] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.702] GetProcessHeap () returned 0x840000 [0091.702] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.704] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.705] GetProcessHeap () returned 0x840000 [0091.705] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.705] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.705] GetProcessHeap () returned 0x840000 [0091.705] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.705] GetProcessHeap () returned 0x840000 [0091.705] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.705] GetProcessHeap () returned 0x840000 [0091.705] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.708] GetProcessHeap () returned 0x840000 [0091.708] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.710] GetProcessHeap () returned 0x840000 [0091.710] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.712] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.713] GetProcessHeap () returned 0x840000 [0091.713] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.713] GetProcessHeap () returned 0x840000 [0091.713] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.716] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.716] GetProcessHeap () returned 0x840000 [0091.717] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.717] GetProcessHeap () returned 0x840000 [0091.717] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.717] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.717] GetProcessHeap () returned 0x840000 [0091.717] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.717] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.717] GetProcessHeap () returned 0x840000 [0091.717] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.718] GetProcessHeap () returned 0x840000 [0091.718] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.720] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.721] GetProcessHeap () returned 0x840000 [0091.721] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.721] GetProcessHeap () returned 0x840000 [0091.721] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.721] GetProcessHeap () returned 0x840000 [0091.721] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.722] GetProcessHeap () returned 0x840000 [0091.722] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0091.723] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0091.723] GetProcessHeap () returned 0x840000 [0091.723] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.723] GetProcessHeap () returned 0x840000 [0091.723] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0091.723] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0091.723] GetProcessHeap () returned 0x840000 [0091.723] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.723] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.724] GetProcessHeap () returned 0x840000 [0091.724] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.724] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.724] GetProcessHeap () returned 0x840000 [0091.724] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.724] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.724] GetProcessHeap () returned 0x840000 [0091.724] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.725] GetProcessHeap () returned 0x840000 [0091.726] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.726] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.726] GetProcessHeap () returned 0x840000 [0091.726] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.726] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.726] GetProcessHeap () returned 0x840000 [0091.726] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.726] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.726] GetProcessHeap () returned 0x840000 [0091.726] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af1060 | out: hHeap=0x840000) returned 1 [0091.727] GetProcessHeap () returned 0x840000 [0091.727] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.727] GetProcessHeap () returned 0x840000 [0091.727] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.730] GetProcessHeap () returned 0x840000 [0091.730] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.730] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.730] GetProcessHeap () returned 0x840000 [0091.730] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.730] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.730] GetProcessHeap () returned 0x840000 [0091.730] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.730] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.731] GetProcessHeap () returned 0x840000 [0091.731] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.732] GetProcessHeap () returned 0x840000 [0091.732] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.732] GetProcessHeap () returned 0x840000 [0091.732] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.733] GetProcessHeap () returned 0x840000 [0091.733] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.831] GetProcessHeap () returned 0x840000 [0091.831] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.869] GetProcessHeap () returned 0x840000 [0091.869] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.870] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.870] GetProcessHeap () returned 0x840000 [0091.870] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.870] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.870] GetProcessHeap () returned 0x840000 [0091.870] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.870] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.870] GetProcessHeap () returned 0x840000 [0091.870] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.871] GetProcessHeap () returned 0x840000 [0091.871] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.872] GetProcessHeap () returned 0x840000 [0091.872] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.874] GetProcessHeap () returned 0x840000 [0091.874] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.876] GetProcessHeap () returned 0x840000 [0091.876] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0091.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0091.876] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0091.876] GetProcessHeap () returned 0x840000 [0091.876] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0091.876] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.876] GetProcessHeap () returned 0x840000 [0091.876] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.876] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.877] GetProcessHeap () returned 0x840000 [0091.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.877] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.877] GetProcessHeap () returned 0x840000 [0091.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.878] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.878] GetProcessHeap () returned 0x840000 [0091.878] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.878] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.878] GetProcessHeap () returned 0x840000 [0091.878] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.878] GetProcessHeap () returned 0x840000 [0091.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x768d45c0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768d45c0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.878] GetProcessHeap () returned 0x840000 [0091.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.878] GetProcessHeap () returned 0x840000 [0091.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.881] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.881] GetProcessHeap () returned 0x840000 [0091.881] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.881] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.881] GetProcessHeap () returned 0x840000 [0091.882] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.882] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.882] GetProcessHeap () returned 0x840000 [0091.882] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.883] GetProcessHeap () returned 0x840000 [0091.883] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76888300, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76888300, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.883] GetProcessHeap () returned 0x840000 [0091.883] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.885] GetProcessHeap () returned 0x840000 [0091.885] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.885] GetProcessHeap () returned 0x840000 [0091.885] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.886] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.886] GetProcessHeap () returned 0x840000 [0091.886] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.886] GetProcessHeap () returned 0x840000 [0091.886] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.886] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.886] GetProcessHeap () returned 0x840000 [0091.886] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.886] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.886] GetProcessHeap () returned 0x840000 [0091.886] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.886] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.886] GetProcessHeap () returned 0x840000 [0091.886] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.886] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.886] GetProcessHeap () returned 0x840000 [0091.886] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.887] GetProcessHeap () returned 0x840000 [0091.887] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.888] GetProcessHeap () returned 0x840000 [0091.888] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.888] GetProcessHeap () returned 0x840000 [0091.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0091.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0091.889] GetProcessHeap () returned 0x840000 [0091.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.891] GetProcessHeap () returned 0x840000 [0091.891] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.891] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.891] GetProcessHeap () returned 0x840000 [0091.892] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.892] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.892] GetProcessHeap () returned 0x840000 [0091.892] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.892] GetProcessHeap () returned 0x840000 [0091.892] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0091.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0091.894] GetProcessHeap () returned 0x840000 [0091.894] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0091.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0091.894] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0091.894] GetProcessHeap () returned 0x840000 [0091.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0091.894] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0091.894] GetProcessHeap () returned 0x840000 [0091.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0091.894] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0091.894] GetProcessHeap () returned 0x840000 [0091.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0091.895] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.895] GetProcessHeap () returned 0x840000 [0091.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.895] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.895] GetProcessHeap () returned 0x840000 [0091.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.896] GetProcessHeap () returned 0x840000 [0091.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.896] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.896] GetProcessHeap () returned 0x840000 [0091.896] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.896] GetProcessHeap () returned 0x840000 [0091.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.896] GetProcessHeap () returned 0x840000 [0091.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.896] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.896] GetProcessHeap () returned 0x840000 [0091.896] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.897] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.897] GetProcessHeap () returned 0x840000 [0091.897] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.897] GetProcessHeap () returned 0x840000 [0091.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.898] GetProcessHeap () returned 0x840000 [0091.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.900] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.900] GetProcessHeap () returned 0x840000 [0091.900] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.900] GetProcessHeap () returned 0x840000 [0091.900] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.902] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.903] GetProcessHeap () returned 0x840000 [0091.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.903] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.903] GetProcessHeap () returned 0x840000 [0091.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.903] GetProcessHeap () returned 0x840000 [0091.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x768ae460, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768ae460, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.903] GetProcessHeap () returned 0x840000 [0091.903] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0091.903] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0091.903] GetProcessHeap () returned 0x840000 [0091.903] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0091.903] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0091.904] GetProcessHeap () returned 0x840000 [0091.904] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0091.904] GetProcessHeap () returned 0x840000 [0091.904] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0091.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0091.904] GetProcessHeap () returned 0x840000 [0091.904] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0091.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.014] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.015] GetProcessHeap () returned 0x840000 [0092.015] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.015] GetProcessHeap () returned 0x840000 [0092.015] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.015] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.015] GetProcessHeap () returned 0x840000 [0092.016] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.016] GetProcessHeap () returned 0x840000 [0092.016] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.018] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.018] GetProcessHeap () returned 0x840000 [0092.018] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.018] GetProcessHeap () returned 0x840000 [0092.018] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.020] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.021] GetProcessHeap () returned 0x840000 [0092.021] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.021] GetProcessHeap () returned 0x840000 [0092.021] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.021] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.021] GetProcessHeap () returned 0x840000 [0092.021] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.022] GetProcessHeap () returned 0x840000 [0092.022] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.022] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.022] GetProcessHeap () returned 0x840000 [0092.022] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.022] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0092.022] GetProcessHeap () returned 0x840000 [0092.022] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0092.022] GetProcessHeap () returned 0x840000 [0092.022] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0092.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0092.022] GetProcessHeap () returned 0x840000 [0092.022] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.022] GetProcessHeap () returned 0x840000 [0092.023] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.023] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.023] GetProcessHeap () returned 0x840000 [0092.023] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.023] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.023] GetProcessHeap () returned 0x840000 [0092.023] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.024] GetProcessHeap () returned 0x840000 [0092.024] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.024] GetProcessHeap () returned 0x840000 [0092.024] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.024] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.024] GetProcessHeap () returned 0x840000 [0092.024] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.024] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.024] GetProcessHeap () returned 0x840000 [0092.024] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.024] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0092.024] GetProcessHeap () returned 0x840000 [0092.024] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0092.026] GetProcessHeap () returned 0x840000 [0092.026] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0092.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0092.027] GetProcessHeap () returned 0x840000 [0092.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.027] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.027] GetProcessHeap () returned 0x840000 [0092.028] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.028] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0092.028] GetProcessHeap () returned 0x840000 [0092.028] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0092.028] GetProcessHeap () returned 0x840000 [0092.028] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0092.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76cfec40, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76cfec40, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0092.028] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0092.028] GetProcessHeap () returned 0x840000 [0092.028] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0092.028] GetProcessHeap () returned 0x840000 [0092.028] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0092.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0092.029] GetProcessHeap () returned 0x840000 [0092.029] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.029] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0092.029] GetProcessHeap () returned 0x840000 [0092.029] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0092.029] GetProcessHeap () returned 0x840000 [0092.029] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0092.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0092.037] GetProcessHeap () returned 0x840000 [0092.037] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.038] GetProcessHeap () returned 0x840000 [0092.038] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.038] GetProcessHeap () returned 0x840000 [0092.038] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.039] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.039] GetProcessHeap () returned 0x840000 [0092.039] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.039] GetProcessHeap () returned 0x840000 [0092.039] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.047] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.047] GetProcessHeap () returned 0x840000 [0092.047] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.047] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.049] GetProcessHeap () returned 0x840000 [0092.049] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.049] GetProcessHeap () returned 0x840000 [0092.049] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.083] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.084] GetProcessHeap () returned 0x840000 [0092.084] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.084] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.084] GetProcessHeap () returned 0x840000 [0092.084] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.085] GetProcessHeap () returned 0x840000 [0092.085] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.085] GetProcessHeap () returned 0x840000 [0092.085] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.086] GetProcessHeap () returned 0x840000 [0092.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.087] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.087] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0092.087] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0092.087] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0092.087] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.087] GetProcessHeap () returned 0x840000 [0092.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.087] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0092.088] GetProcessHeap () returned 0x840000 [0092.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.088] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timeZones.js", cAlternateFileName="")) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timeZones.js", cAlternateFileName="")) returned 0 [0092.088] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.088] GetProcessHeap () returned 0x840000 [0092.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0092.088] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.088] GetProcessHeap () returned 0x840000 [0092.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.088] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285ac06b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0092.089] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0092.089] GetProcessHeap () returned 0x840000 [0092.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.090] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828d4d58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828d4d58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_dot.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82888a9e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82888a9e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_h.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828aebfb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828aebfb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285f8327, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_m.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828d4d58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828d4d58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x285f8327, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc63, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_s.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828d4d58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828d4d58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7454, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_settings.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828faeb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828faeb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x77b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8294716f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8294716f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_dot.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828faeb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x828faeb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2861e485, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_h.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82921012, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82921012, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x286445e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_m.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82921012, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82921012, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x286445e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_s.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8296d2cc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8296d2cc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7fb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_settings.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82993429, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82993429, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x876e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower.png", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829df6e3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x829df6e3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_dot.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82993429, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82993429, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2866a741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_h.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829b9586, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x829b9586, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287c138f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_m.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829b9586, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x829b9586, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287c138f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_s.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a05840, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a05840, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287e74ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x827b, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_settings.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a05840, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a05840, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287e74ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3cfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a51afa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a51afa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x287e74ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_dot.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a2b99d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a2b99d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2880d64b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_h.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a2b99d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a2b99d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2880d64b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_m.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a51afa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a51afa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2880d64b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbde, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_s.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a51afa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a51afa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288337a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x51d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_settings.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a77c57, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a77c57, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288337a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6408, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aea06e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82aea06e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288337a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_dot.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a9ddb4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82a9ddb4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28859907, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_h.png", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ac3f11, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82ac3f11, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28859907, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_m.png", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aea06e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82aea06e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28859907, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_s.png", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b101cb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b101cb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2887fa65, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x702e, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_settings.png", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cff384, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cff384, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2887fa65, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d254e1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d254e1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288a5bc3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d254e1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d254e1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288a5bc3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4b63e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d4b63e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288cbd21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4b63e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d4b63e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288f1e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4b63e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d4b63e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288f1e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7179b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d7179b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x288f1e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7179b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d7179b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a2296f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d7179b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d7179b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a2296f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a48acd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28a48acd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28ae1045, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d978f8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82d978f8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b071a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82dbda55, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82dbda55, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b2d301, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82de3bb2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82de3bb2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b2d301, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82de3bb2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82de3bb2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b5345f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e09d0f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e09d0f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b795bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e09d0f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e09d0f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b795bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e2fe6c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e2fe6c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b795bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e2fe6c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e2fe6c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b9f71b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e55fc9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82e55fc9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28b9f71b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b101cb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b101cb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28bc5879, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacer_highlights.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b36328, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b36328, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28bc5879, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="square.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b825e2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b825e2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28beb9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_dot.png", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b36328, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b36328, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28beb9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_h.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b5c485, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b5c485, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c37c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_m.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b5c485, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b5c485, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c37c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_s.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b825e2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82b825e2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c37c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4d87, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_settings.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ba873f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82ba873f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c5ddf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x519b, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c1ab56, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c1ab56, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c5ddf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_dot.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bce89c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82bce89c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c83f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_h.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bf49f9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82bf49f9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c83f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_m.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bf49f9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82bf49f9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28c83f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_s.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c40cb3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c40cb3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28caa0ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5a3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_settings.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c66e10, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c66e10, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28caa0ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4c3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cd9227, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cd9227, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28cd020b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_dot.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c66e10, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c66e10, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28cd020b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_h.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c8cf6d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82c8cf6d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28ddab9d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_m.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cb30ca, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cb30ca, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e00cfb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_s.png", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cff384, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cff384, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e00cfb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5385, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_settings.png", cAlternateFileName="")) returned 1 [0092.097] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cff384, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82cff384, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e00cfb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5385, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_settings.png", cAlternateFileName="")) returned 0 [0092.097] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.097] GetProcessHeap () returned 0x840000 [0092.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843c2419, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x843c2419, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e73115, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0092.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843c2419, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x843c2419, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e73115, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0092.098] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.098] GetProcessHeap () returned 0x840000 [0092.098] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.098] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0092.099] GetProcessHeap () returned 0x840000 [0092.099] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.099] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.099] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29088439, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0092.099] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.099] GetProcessHeap () returned 0x840000 [0092.099] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.215] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.215] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0092.215] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0092.215] GetProcessHeap () returned 0x840000 [0092.215] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.216] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.216] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0092.216] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 0 [0092.216] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.216] GetProcessHeap () returned 0x840000 [0092.216] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.216] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0092.216] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0092.216] GetProcessHeap () returned 0x840000 [0092.216] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.216] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.216] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0092.216] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 0 [0092.216] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.217] GetProcessHeap () returned 0x840000 [0092.217] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.217] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0092.217] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.217] GetProcessHeap () returned 0x840000 [0092.217] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.217] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290ae597, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x290ae597, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x23e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0092.217] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0092.217] GetProcessHeap () returned 0x840000 [0092.217] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="back.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290fa853, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6651, dwReserved0=0x0, dwReserved1=0x0, cFileName="back_lrg.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290fa853, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x290fa853, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x290fa853, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc91, dwReserved0=0x0, dwReserved1=0x0, cFileName="dialdot.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="dialdot_lrg.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84291931, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84291931, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290fa853, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial_lrg.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84291931, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84291931, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291209b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc03, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial_lrg_sml.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8426b7d4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8426b7d4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291209b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial_sml.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.png", cAlternateFileName="")) returned 1 [0092.322] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84303d48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84303d48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass_lrg.png", cAlternateFileName="")) returned 1 [0092.323] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84303d48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84303d48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29146b0f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass_lrg.png", cAlternateFileName="")) returned 0 [0092.323] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.323] GetProcessHeap () returned 0x840000 [0092.323] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.323] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291b8f29, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0092.323] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x291b8f29, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0092.323] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.324] GetProcessHeap () returned 0x840000 [0092.324] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.324] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0092.325] GetProcessHeap () returned 0x840000 [0092.325] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.433] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.433] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296096cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0092.433] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.433] GetProcessHeap () returned 0x840000 [0092.433] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.433] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.433] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0092.433] GetProcessHeap () returned 0x840000 [0092.434] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0092.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 0 [0092.435] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.435] GetProcessHeap () returned 0x840000 [0092.435] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.435] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1792, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.html", cAlternateFileName="")) returned 1 [0092.435] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0092.436] GetProcessHeap () returned 0x840000 [0092.436] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="init.js", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2bf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 0 [0092.436] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.436] GetProcessHeap () returned 0x840000 [0092.436] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.436] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0092.436] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.437] GetProcessHeap () returned 0x840000 [0092.437] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.437] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x296c7da5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x296c7da5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae9, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0092.437] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0092.437] GetProcessHeap () returned 0x840000 [0092.437] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.480] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863263c0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863263c0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_down.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863263c0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863263c0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296edf03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_over.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86300263, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86300263, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296edf03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_up.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862b3fa9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862b3fa9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-docked.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29714061, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x29714061, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xaa66, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-2.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86267cef, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86267cef, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd31a, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-3.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8628de4c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8628de4c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2973a1bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf240, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-4.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863987d7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863987d7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb93, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-left.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863be934, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863be934, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb45, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-middle.png", cAlternateFileName="")) returned 1 [0092.481] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863be934, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863be934, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-right.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a33d17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_down.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a33d17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_over.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_up.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863987d7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863987d7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_down.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637267a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8637267a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_over.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637267a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8637267a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a7ffd3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_up.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29acc28f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863e4a91, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863e4a91, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x0, dwReserved1=0x0, cFileName="row_over.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862da106, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862da106, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 1 [0092.482] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862da106, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862da106, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 0 [0092.482] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.483] GetProcessHeap () returned 0x840000 [0092.483] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.483] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29e5e35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0092.484] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29e5e35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0092.484] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.484] GetProcessHeap () returned 0x840000 [0092.484] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.485] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.Gadget", cAlternateFileName="MEDIAC~1.GAD")) returned 1 [0092.485] GetProcessHeap () returned 0x840000 [0092.485] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.560] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.560] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0092.560] GetProcessHeap () returned 0x840000 [0092.560] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.560] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.560] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0092.560] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0092.560] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0092.561] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0092.561] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.561] GetProcessHeap () returned 0x840000 [0092.561] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.561] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.561] GetProcessHeap () returned 0x840000 [0092.561] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.561] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.561] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0092.561] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 0 [0092.561] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.561] GetProcessHeap () returned 0x840000 [0092.561] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.561] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0092.561] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0092.561] GetProcessHeap () returned 0x840000 [0092.561] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.563] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mousedown.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc903c050, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc903c050, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mouseout.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90621ad, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90621ad, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mouseover.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90621ad, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90621ad, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_MCELogo_mousedown.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_MCELogo_mouseout.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_MCELogo_mouseover.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_play.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_mousedown.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_mouseout.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_mouseover.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x61ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_thumb.jpg", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1682, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehshellLogo.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout_background.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Flyout_Thumbnail_Shadow.png", cAlternateFileName="")) returned 1 [0092.564] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc912087e, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc912087e, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x24db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Main_Background_Loading.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91469db, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc91469db, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Main_Background_QuickLaunch.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91469db, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc91469db, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x86e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Main_Gradient.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Star_Empty.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Star_Full.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Star_Half.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9192c95, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9192c95, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Waitcursor.gif", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9192c95, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9192c95, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_WMC_LogoText.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="main_background.png", cAlternateFileName="")) returned 1 [0092.565] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="main_background.png", cAlternateFileName="")) returned 0 [0092.565] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.566] GetProcessHeap () returned 0x840000 [0092.566] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.566] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0092.566] GetProcessHeap () returned 0x840000 [0092.566] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.566] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.566] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbf39ab, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fbf39ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xecdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0092.566] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x71a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0092.566] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x71a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0092.567] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.567] GetProcessHeap () returned 0x840000 [0092.567] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x294e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="")) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a59d04, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x9e9e7900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xe17d845, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCESidebarCtrl.dll", cAlternateFileName="")) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5862, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5862, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0092.567] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.567] GetProcessHeap () returned 0x840000 [0092.567] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0092.567] GetProcessHeap () returned 0x840000 [0092.567] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38816739, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0092.567] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.568] GetProcessHeap () returned 0x840000 [0092.568] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.568] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.568] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0092.568] GetProcessHeap () returned 0x840000 [0092.568] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.569] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.569] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0092.569] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0092.569] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0092.569] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.569] GetProcessHeap () returned 0x840000 [0092.569] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0092.570] GetProcessHeap () returned 0x840000 [0092.570] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.570] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0092.570] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.570] GetProcessHeap () returned 0x840000 [0092.570] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.html", cAlternateFileName="")) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0092.570] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0092.570] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.570] GetProcessHeap () returned 0x840000 [0092.571] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.571] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388629f5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x388629f5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0092.571] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0092.571] GetProcessHeap () returned 0x840000 [0092.571] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.572] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38888b53, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x38888b53, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8498f944, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8498f944, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5323, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a4e015, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a4e015, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x388aecb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38947229, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6936, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b5aa1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849b5aa1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x389b9643, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7210, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b5aa1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849b5aa1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x389df7a1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849dbbfe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849dbbfe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38cd92f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a01d5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a01d5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38cff457, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a01d5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a01d5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39103941, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.png", cAlternateFileName="")) returned 1 [0092.583] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a27eb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a27eb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39da8d77, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x493b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.png", cAlternateFileName="")) returned 1 [0092.584] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a27eb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a27eb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39eb3709, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x52a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.png", cAlternateFileName="")) returned 1 [0092.584] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.585] GetProcessHeap () returned 0x840000 [0092.585] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.585] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.585] GetProcessHeap () returned 0x840000 [0092.585] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.587] GetProcessHeap () returned 0x840000 [0092.587] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.587] GetProcessHeap () returned 0x840000 [0092.587] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.592] GetProcessHeap () returned 0x840000 [0092.592] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.593] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.593] GetProcessHeap () returned 0x840000 [0092.593] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.593] GetProcessHeap () returned 0x840000 [0092.593] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.593] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.593] GetProcessHeap () returned 0x840000 [0092.593] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.593] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.593] GetProcessHeap () returned 0x840000 [0092.593] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.593] GetProcessHeap () returned 0x840000 [0092.593] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.621] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.662] GetProcessHeap () returned 0x840000 [0092.662] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.662] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.662] GetProcessHeap () returned 0x840000 [0092.662] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.663] GetProcessHeap () returned 0x840000 [0092.663] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.674] GetProcessHeap () returned 0x840000 [0092.674] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.675] GetProcessHeap () returned 0x840000 [0092.675] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.675] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.676] GetProcessHeap () returned 0x840000 [0092.676] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.676] GetProcessHeap () returned 0x840000 [0092.676] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.676] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.676] GetProcessHeap () returned 0x840000 [0092.676] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.676] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.676] GetProcessHeap () returned 0x840000 [0092.676] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.676] GetProcessHeap () returned 0x840000 [0092.676] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.775] GetProcessHeap () returned 0x840000 [0092.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.775] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.775] GetProcessHeap () returned 0x840000 [0092.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.775] GetProcessHeap () returned 0x840000 [0092.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.776] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.776] GetProcessHeap () returned 0x840000 [0092.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.776] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.776] GetProcessHeap () returned 0x840000 [0092.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.776] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0092.776] GetProcessHeap () returned 0x840000 [0092.776] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0092.777] GetProcessHeap () returned 0x840000 [0092.777] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0092.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0092.778] GetProcessHeap () returned 0x840000 [0092.778] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.789] GetProcessHeap () returned 0x840000 [0092.789] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.790] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.790] GetProcessHeap () returned 0x840000 [0092.790] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.790] GetProcessHeap () returned 0x840000 [0092.790] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.791] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.791] GetProcessHeap () returned 0x840000 [0092.791] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.791] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0092.791] GetProcessHeap () returned 0x840000 [0092.791] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0092.791] GetProcessHeap () returned 0x840000 [0092.791] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0092.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0092.896] GetProcessHeap () returned 0x840000 [0092.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.910] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.910] GetProcessHeap () returned 0x840000 [0092.910] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0092.910] GetProcessHeap () returned 0x840000 [0092.910] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0092.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0092.914] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0092.914] GetProcessHeap () returned 0x840000 [0092.914] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.073] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0093.074] GetProcessHeap () returned 0x840000 [0093.074] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0093.074] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0093.074] GetProcessHeap () returned 0x840000 [0093.074] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0093.075] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0093.075] GetProcessHeap () returned 0x840000 [0093.075] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0093.075] GetProcessHeap () returned 0x840000 [0093.075] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0093.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0093.075] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0093.075] GetProcessHeap () returned 0x840000 [0093.075] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0093.075] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0093.075] GetProcessHeap () returned 0x840000 [0093.076] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0093.076] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0093.076] GetProcessHeap () returned 0x840000 [0093.076] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0093.076] GetProcessHeap () returned 0x840000 [0093.076] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0093.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0093.076] GetProcessHeap () returned 0x840000 [0093.076] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0093.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf40b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf40b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0093.076] GetProcessHeap () returned 0x840000 [0093.076] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0093.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0093.077] GetProcessHeap () returned 0x840000 [0093.077] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0093.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0093.078] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0093.078] GetProcessHeap () returned 0x840000 [0093.078] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0093.078] GetProcessHeap () returned 0x840000 [0093.078] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0093.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0093.078] GetProcessHeap () returned 0x840000 [0093.078] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0093.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0093.080] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0093.081] GetProcessHeap () returned 0x840000 [0093.081] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0093.081] GetProcessHeap () returned 0x840000 [0093.081] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0093.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0093.083] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0093.083] GetProcessHeap () returned 0x840000 [0093.083] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0093.083] GetProcessHeap () returned 0x840000 [0093.083] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0093.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0093.085] GetProcessHeap () returned 0x840000 [0093.086] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.087] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.088] GetProcessHeap () returned 0x840000 [0093.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.088] GetProcessHeap () returned 0x840000 [0093.088] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.088] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.088] GetProcessHeap () returned 0x840000 [0093.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.089] GetProcessHeap () returned 0x840000 [0093.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.089] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.089] GetProcessHeap () returned 0x840000 [0093.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.089] GetProcessHeap () returned 0x840000 [0093.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.090] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.090] GetProcessHeap () returned 0x840000 [0093.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.090] GetProcessHeap () returned 0x840000 [0093.090] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.091] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.091] GetProcessHeap () returned 0x840000 [0093.091] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.091] GetProcessHeap () returned 0x840000 [0093.091] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.092] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.092] GetProcessHeap () returned 0x840000 [0093.092] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.092] GetProcessHeap () returned 0x840000 [0093.092] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.093] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.097] GetProcessHeap () returned 0x840000 [0093.097] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.097] GetProcessHeap () returned 0x840000 [0093.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.100] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.100] GetProcessHeap () returned 0x840000 [0093.100] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.100] GetProcessHeap () returned 0x840000 [0093.100] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.101] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.101] GetProcessHeap () returned 0x840000 [0093.101] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.101] GetProcessHeap () returned 0x840000 [0093.101] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.102] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.102] GetProcessHeap () returned 0x840000 [0093.102] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.102] GetProcessHeap () returned 0x840000 [0093.102] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.102] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.102] GetProcessHeap () returned 0x840000 [0093.102] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.103] GetProcessHeap () returned 0x840000 [0093.103] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.103] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.103] GetProcessHeap () returned 0x840000 [0093.103] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.103] GetProcessHeap () returned 0x840000 [0093.103] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.104] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.104] GetProcessHeap () returned 0x840000 [0093.104] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.104] GetProcessHeap () returned 0x840000 [0093.104] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.104] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.105] GetProcessHeap () returned 0x840000 [0093.105] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.105] GetProcessHeap () returned 0x840000 [0093.105] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.105] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.105] GetProcessHeap () returned 0x840000 [0093.105] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.105] GetProcessHeap () returned 0x840000 [0093.105] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.106] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.106] GetProcessHeap () returned 0x840000 [0093.106] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.106] GetProcessHeap () returned 0x840000 [0093.106] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.106] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.107] GetProcessHeap () returned 0x840000 [0093.107] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.107] GetProcessHeap () returned 0x840000 [0093.107] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.107] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.107] GetProcessHeap () returned 0x840000 [0093.107] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.107] GetProcessHeap () returned 0x840000 [0093.107] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.108] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.108] GetProcessHeap () returned 0x840000 [0093.108] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.108] GetProcessHeap () returned 0x840000 [0093.108] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.109] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.109] GetProcessHeap () returned 0x840000 [0093.109] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.109] GetProcessHeap () returned 0x840000 [0093.109] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.109] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.109] GetProcessHeap () returned 0x840000 [0093.109] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.110] GetProcessHeap () returned 0x840000 [0093.110] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.110] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.110] GetProcessHeap () returned 0x840000 [0093.110] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.110] GetProcessHeap () returned 0x840000 [0093.111] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.111] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.111] GetProcessHeap () returned 0x840000 [0093.111] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.111] GetProcessHeap () returned 0x840000 [0093.111] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.112] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.112] GetProcessHeap () returned 0x840000 [0093.112] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.112] GetProcessHeap () returned 0x840000 [0093.112] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.112] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.113] GetProcessHeap () returned 0x840000 [0093.113] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.113] GetProcessHeap () returned 0x840000 [0093.113] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.113] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.113] GetProcessHeap () returned 0x840000 [0093.113] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.113] GetProcessHeap () returned 0x840000 [0093.114] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.114] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.114] GetProcessHeap () returned 0x840000 [0093.114] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.114] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0093.114] GetProcessHeap () returned 0x840000 [0093.114] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0093.114] GetProcessHeap () returned 0x840000 [0093.114] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0093.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0093.114] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0093.114] GetProcessHeap () returned 0x840000 [0093.114] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0093.114] GetProcessHeap () returned 0x840000 [0093.114] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0093.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0093.116] GetProcessHeap () returned 0x840000 [0093.116] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.117] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.117] GetProcessHeap () returned 0x840000 [0093.117] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.117] GetProcessHeap () returned 0x840000 [0093.117] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.118] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.118] GetProcessHeap () returned 0x840000 [0093.118] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.118] GetProcessHeap () returned 0x840000 [0093.118] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.127] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.127] GetProcessHeap () returned 0x840000 [0093.127] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.127] GetProcessHeap () returned 0x840000 [0093.127] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.134] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.134] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.134] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.134] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.134] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.134] GetProcessHeap () returned 0x840000 [0093.134] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.134] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0093.134] GetProcessHeap () returned 0x840000 [0093.134] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.140] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.140] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.140] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.140] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.140] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.140] GetProcessHeap () returned 0x840000 [0093.140] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.141] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0093.141] GetProcessHeap () returned 0x840000 [0093.141] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.141] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.141] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.141] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.141] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.141] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.141] GetProcessHeap () returned 0x840000 [0093.141] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.141] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0093.141] GetProcessHeap () returned 0x840000 [0093.141] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.143] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.143] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.143] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.143] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.143] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.143] GetProcessHeap () returned 0x840000 [0093.143] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.143] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0093.143] GetProcessHeap () returned 0x840000 [0093.143] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.149] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.149] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.149] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.149] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.149] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.150] GetProcessHeap () returned 0x840000 [0093.150] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.150] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0093.150] GetProcessHeap () returned 0x840000 [0093.150] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.150] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.150] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.150] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.150] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.150] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.150] GetProcessHeap () returned 0x840000 [0093.150] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.150] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0093.150] GetProcessHeap () returned 0x840000 [0093.150] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.153] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.153] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.153] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.153] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.153] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.153] GetProcessHeap () returned 0x840000 [0093.153] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.153] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0093.153] GetProcessHeap () returned 0x840000 [0093.153] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.155] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.155] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.155] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.155] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.155] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.155] GetProcessHeap () returned 0x840000 [0093.155] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.155] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0093.155] GetProcessHeap () returned 0x840000 [0093.155] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.156] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.156] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.156] GetProcessHeap () returned 0x840000 [0093.156] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0093.156] GetProcessHeap () returned 0x840000 [0093.156] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.157] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.158] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.158] GetProcessHeap () returned 0x840000 [0093.158] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.158] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0093.158] GetProcessHeap () returned 0x840000 [0093.158] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.159] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.159] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.159] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.159] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.159] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.159] GetProcessHeap () returned 0x840000 [0093.159] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.159] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0093.159] GetProcessHeap () returned 0x840000 [0093.159] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.258] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.258] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.258] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.258] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.258] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.258] GetProcessHeap () returned 0x840000 [0093.258] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.258] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0093.258] GetProcessHeap () returned 0x840000 [0093.258] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.270] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.270] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.270] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.271] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.271] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.271] GetProcessHeap () returned 0x840000 [0093.271] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.271] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0093.271] GetProcessHeap () returned 0x840000 [0093.271] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.271] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.271] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.271] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.271] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.271] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.271] GetProcessHeap () returned 0x840000 [0093.271] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.271] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0093.272] GetProcessHeap () returned 0x840000 [0093.272] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.275] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.275] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.275] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.275] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.276] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.276] GetProcessHeap () returned 0x840000 [0093.276] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.276] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0093.276] GetProcessHeap () returned 0x840000 [0093.276] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.286] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.286] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.286] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.286] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.286] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.286] GetProcessHeap () returned 0x840000 [0093.286] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.286] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0093.286] GetProcessHeap () returned 0x840000 [0093.286] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.289] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.289] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.289] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.289] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.289] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.289] GetProcessHeap () returned 0x840000 [0093.289] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.289] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0093.290] GetProcessHeap () returned 0x840000 [0093.290] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.295] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.295] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.296] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.296] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.296] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.297] GetProcessHeap () returned 0x840000 [0093.297] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.297] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0093.297] GetProcessHeap () returned 0x840000 [0093.297] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.297] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.297] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.297] GetProcessHeap () returned 0x840000 [0093.297] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.297] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0093.297] GetProcessHeap () returned 0x840000 [0093.297] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.299] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.299] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.299] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.299] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.299] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.299] GetProcessHeap () returned 0x840000 [0093.299] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.299] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0093.299] GetProcessHeap () returned 0x840000 [0093.299] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.300] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.300] GetProcessHeap () returned 0x840000 [0093.300] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0093.300] GetProcessHeap () returned 0x840000 [0093.300] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.300] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.301] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.301] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.301] GetProcessHeap () returned 0x840000 [0093.301] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.301] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0093.301] GetProcessHeap () returned 0x840000 [0093.301] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.302] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.302] GetProcessHeap () returned 0x840000 [0093.302] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0093.302] GetProcessHeap () returned 0x840000 [0093.302] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0093.303] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0093.303] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.303] GetProcessHeap () returned 0x840000 [0093.303] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.303] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 0 [0093.303] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0093.303] GetProcessHeap () returned 0x840000 [0093.303] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0093.303] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0093.303] GetProcessHeap () returned 0x840000 [0093.303] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0093.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0093.307] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.307] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0093.307] GetProcessHeap () returned 0x840000 [0093.307] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CAT", cAlternateFileName="ADOBEC~1.CAT")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CAT", cAlternateFileName="BRDLAN~1.CAT")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CAT", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CAT", cAlternateFileName="MAKEAC~1.CAT")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CAT", cAlternateFileName="MULTIM~1.CAT")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CAT", cAlternateFileName="")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x85c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.CAT", cAlternateFileName="")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CAT", cAlternateFileName="")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CAT", cAlternateFileName="READOU~1.CAT")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CAT", cAlternateFileName="")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CAT", cAlternateFileName="SAVEAS~1.CAT")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CAT", cAlternateFileName="")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CAT", cAlternateFileName="")) returned 1 [0093.313] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.313] GetProcessHeap () returned 0x840000 [0093.313] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.316] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.316] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.317] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.317] GetProcessHeap () returned 0x840000 [0093.317] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CAT", cAlternateFileName="")) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 0 [0093.317] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.317] GetProcessHeap () returned 0x840000 [0093.317] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0093.317] GetProcessHeap () returned 0x840000 [0093.317] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CZE", cAlternateFileName="ADOBEC~1.CZE")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CZE", cAlternateFileName="BRDLAN~1.CZE")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CZE", cAlternateFileName="")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CZE", cAlternateFileName="MAKEAC~1.CZE")) returned 1 [0093.379] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CZE", cAlternateFileName="MULTIM~1.CZE")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CZE", cAlternateFileName="")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.CZE", cAlternateFileName="")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CZE", cAlternateFileName="")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CZE", cAlternateFileName="READOU~1.CZE")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CZE", cAlternateFileName="")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CZE", cAlternateFileName="SAVEAS~1.CZE")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CZE", cAlternateFileName="")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CZE", cAlternateFileName="")) returned 1 [0093.380] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.380] GetProcessHeap () returned 0x840000 [0093.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.381] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.381] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.381] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.381] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.381] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.381] GetProcessHeap () returned 0x840000 [0093.381] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.381] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0093.382] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CZE", cAlternateFileName="")) returned 1 [0093.382] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 1 [0093.382] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 0 [0093.382] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.382] GetProcessHeap () returned 0x840000 [0093.382] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.382] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0093.382] GetProcessHeap () returned 0x840000 [0093.382] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.483] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.483] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0093.483] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x64600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.DAN", cAlternateFileName="ADOBEC~1.DAN")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.DAN", cAlternateFileName="BRDLAN~1.DAN")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.DAN", cAlternateFileName="MAKEAC~1.DAN")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.DAN", cAlternateFileName="MULTIM~1.DAN")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.DAN", cAlternateFileName="")) returned 1 [0093.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.DAN", cAlternateFileName="READOU~1.DAN")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.DAN", cAlternateFileName="")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.DAN", cAlternateFileName="SAVEAS~1.DAN")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.DAN", cAlternateFileName="")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.DAN", cAlternateFileName="")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.485] GetProcessHeap () returned 0x840000 [0093.485] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.485] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.485] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.485] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.485] GetProcessHeap () returned 0x840000 [0093.486] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.486] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0093.486] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.DAN", cAlternateFileName="")) returned 1 [0093.486] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 1 [0093.486] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 0 [0093.486] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.486] GetProcessHeap () returned 0x840000 [0093.486] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.486] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0093.486] GetProcessHeap () returned 0x840000 [0093.486] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.DEU", cAlternateFileName="ADOBEC~1.DEU")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.DEU", cAlternateFileName="BRDLAN~1.DEU")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Escript.deu", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.DEU", cAlternateFileName="")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.DEU", cAlternateFileName="MAKEAC~1.DEU")) returned 1 [0093.549] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.DEU", cAlternateFileName="MULTIM~1.DEU")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.DEU", cAlternateFileName="")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.DEU", cAlternateFileName="")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.DEU", cAlternateFileName="")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.DEU", cAlternateFileName="READOU~1.DEU")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.DEU", cAlternateFileName="")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.DEU", cAlternateFileName="SAVEAS~1.DEU")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.DEU", cAlternateFileName="")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.deu", cAlternateFileName="")) returned 1 [0093.550] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.550] GetProcessHeap () returned 0x840000 [0093.550] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.554] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.554] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.554] GetProcessHeap () returned 0x840000 [0093.554] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.DEU", cAlternateFileName="")) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 1 [0093.555] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.555] GetProcessHeap () returned 0x840000 [0093.555] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.555] GetProcessHeap () returned 0x840000 [0093.555] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.621] GetProcessHeap () returned 0x840000 [0093.621] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.622] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.622] GetProcessHeap () returned 0x840000 [0093.622] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.622] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.622] GetProcessHeap () returned 0x840000 [0093.622] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.622] GetProcessHeap () returned 0x840000 [0093.622] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.665] GetProcessHeap () returned 0x840000 [0093.665] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.665] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.665] GetProcessHeap () returned 0x840000 [0093.665] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.665] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.665] GetProcessHeap () returned 0x840000 [0093.665] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.665] GetProcessHeap () returned 0x840000 [0093.665] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.667] GetProcessHeap () returned 0x840000 [0093.667] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.668] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.668] GetProcessHeap () returned 0x840000 [0093.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.668] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.668] GetProcessHeap () returned 0x840000 [0093.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.668] GetProcessHeap () returned 0x840000 [0093.668] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.670] GetProcessHeap () returned 0x840000 [0093.670] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.670] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.670] GetProcessHeap () returned 0x840000 [0093.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.670] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.670] GetProcessHeap () returned 0x840000 [0093.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.670] GetProcessHeap () returned 0x840000 [0093.670] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.672] GetProcessHeap () returned 0x840000 [0093.672] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.673] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.673] GetProcessHeap () returned 0x840000 [0093.673] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.673] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.673] GetProcessHeap () returned 0x840000 [0093.673] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.673] GetProcessHeap () returned 0x840000 [0093.673] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.675] GetProcessHeap () returned 0x840000 [0093.675] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.675] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.675] GetProcessHeap () returned 0x840000 [0093.675] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.675] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.675] GetProcessHeap () returned 0x840000 [0093.675] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.675] GetProcessHeap () returned 0x840000 [0093.675] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.677] GetProcessHeap () returned 0x840000 [0093.677] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.678] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.678] GetProcessHeap () returned 0x840000 [0093.678] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.678] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.678] GetProcessHeap () returned 0x840000 [0093.678] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.678] GetProcessHeap () returned 0x840000 [0093.678] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.680] GetProcessHeap () returned 0x840000 [0093.680] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.680] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.680] GetProcessHeap () returned 0x840000 [0093.680] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.680] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.680] GetProcessHeap () returned 0x840000 [0093.680] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.681] GetProcessHeap () returned 0x840000 [0093.681] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.682] GetProcessHeap () returned 0x840000 [0093.682] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.684] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.684] GetProcessHeap () returned 0x840000 [0093.684] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.684] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.684] GetProcessHeap () returned 0x840000 [0093.684] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.684] GetProcessHeap () returned 0x840000 [0093.684] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.686] GetProcessHeap () returned 0x840000 [0093.686] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.686] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.686] GetProcessHeap () returned 0x840000 [0093.686] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.686] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.686] GetProcessHeap () returned 0x840000 [0093.686] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.686] GetProcessHeap () returned 0x840000 [0093.686] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.688] GetProcessHeap () returned 0x840000 [0093.688] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.689] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.689] GetProcessHeap () returned 0x840000 [0093.689] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.689] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.689] GetProcessHeap () returned 0x840000 [0093.689] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.689] GetProcessHeap () returned 0x840000 [0093.689] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.691] GetProcessHeap () returned 0x840000 [0093.691] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.691] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.691] GetProcessHeap () returned 0x840000 [0093.691] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.691] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.691] GetProcessHeap () returned 0x840000 [0093.691] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.691] GetProcessHeap () returned 0x840000 [0093.691] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.713] GetProcessHeap () returned 0x840000 [0093.713] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.720] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.720] GetProcessHeap () returned 0x840000 [0093.720] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.720] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.720] GetProcessHeap () returned 0x840000 [0093.720] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.720] GetProcessHeap () returned 0x840000 [0093.720] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.726] GetProcessHeap () returned 0x840000 [0093.726] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.726] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.726] GetProcessHeap () returned 0x840000 [0093.726] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.726] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.726] GetProcessHeap () returned 0x840000 [0093.726] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.726] GetProcessHeap () returned 0x840000 [0093.726] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x65e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.RUS", cAlternateFileName="ADOBEC~1.RUS")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.RUS", cAlternateFileName="BRDLAN~1.RUS")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.RUS", cAlternateFileName="")) returned 1 [0093.741] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.RUS", cAlternateFileName="MAKEAC~1.RUS")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.RUS", cAlternateFileName="MULTIM~1.RUS")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8077d300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.RUS", cAlternateFileName="READOU~1.RUS")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reflow.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.RUS", cAlternateFileName="SAVEAS~1.RUS")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.RUS", cAlternateFileName="")) returned 1 [0093.742] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.742] GetProcessHeap () returned 0x840000 [0093.742] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.746] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.746] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.746] GetProcessHeap () returned 0x840000 [0093.746] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.RUS", cAlternateFileName="")) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.RUS", cAlternateFileName="")) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.RUS", cAlternateFileName="")) returned 1 [0093.746] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.RUS", cAlternateFileName="")) returned 0 [0093.747] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.747] GetProcessHeap () returned 0x840000 [0093.747] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.747] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0093.747] GetProcessHeap () returned 0x840000 [0093.747] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x65800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.SKY", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.SKY", cAlternateFileName="ADOBEC~1.SKY")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.SKY", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.SKY", cAlternateFileName="BRDLAN~1.SKY")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.SKY", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.SKY", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.SKY", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.SKY", cAlternateFileName="")) returned 1 [0093.750] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.SKY", cAlternateFileName="MAKEAC~1.SKY")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.SKY", cAlternateFileName="MULTIM~1.SKY")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8077d300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.SKY", cAlternateFileName="READOU~1.SKY")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.SKY", cAlternateFileName="SAVEAS~1.SKY")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.SKY", cAlternateFileName="")) returned 1 [0093.751] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.751] GetProcessHeap () returned 0x840000 [0093.751] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.752] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.752] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.752] GetProcessHeap () returned 0x840000 [0093.752] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SKY", cAlternateFileName="")) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.SKY", cAlternateFileName="")) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.SKY", cAlternateFileName="")) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8314b560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.SKY", cAlternateFileName="")) returned 0 [0093.752] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.752] GetProcessHeap () returned 0x840000 [0093.752] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.752] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0093.752] GetProcessHeap () returned 0x840000 [0093.752] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.806] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.SLV", cAlternateFileName="ADOBEC~1.SLV")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x75800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.SLV", cAlternateFileName="BRDLAN~1.SLV")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.SLV", cAlternateFileName="MAKEAC~1.SLV")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.SLV", cAlternateFileName="MULTIM~1.SLV")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.SLV", cAlternateFileName="")) returned 1 [0093.807] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.SLV", cAlternateFileName="")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807571a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x146000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.SLV", cAlternateFileName="")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.SLV", cAlternateFileName="READOU~1.SLV")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reflow.SLV", cAlternateFileName="")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.SLV", cAlternateFileName="SAVEAS~1.SLV")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.SLV", cAlternateFileName="")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.SLV", cAlternateFileName="")) returned 1 [0093.808] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.808] GetProcessHeap () returned 0x840000 [0093.808] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.810] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.810] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.810] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.810] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.810] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.810] GetProcessHeap () returned 0x840000 [0093.810] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.810] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SLV", cAlternateFileName="")) returned 1 [0093.810] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.SLV", cAlternateFileName="")) returned 1 [0093.811] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SLV", cAlternateFileName="")) returned 1 [0093.811] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83125400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SLV", cAlternateFileName="")) returned 0 [0093.811] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.811] GetProcessHeap () returned 0x840000 [0093.811] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.811] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0093.811] GetProcessHeap () returned 0x840000 [0093.811] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0093.815] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.815] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 [0093.815] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.SVE", cAlternateFileName="")) returned 1 [0093.815] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.SVE", cAlternateFileName="ADOBEC~1.SVE")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.SVE", cAlternateFileName="BRDLAN~1.SVE")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.SVE", cAlternateFileName="MAKEAC~1.SVE")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.SVE", cAlternateFileName="MULTIM~1.SVE")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x141800, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.SVE", cAlternateFileName="")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.SVE", cAlternateFileName="READOU~1.SVE")) returned 1 [0093.816] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.SVE", cAlternateFileName="")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.SVE", cAlternateFileName="SAVEAS~1.SVE")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.SVE", cAlternateFileName="")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.SVE", cAlternateFileName="")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.817] GetProcessHeap () returned 0x840000 [0093.817] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0093.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.817] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.817] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.817] GetProcessHeap () returned 0x840000 [0093.817] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SVE", cAlternateFileName="")) returned 1 [0093.817] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.SVE", cAlternateFileName="")) returned 1 [0093.818] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SVE", cAlternateFileName="")) returned 1 [0093.818] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SVE", cAlternateFileName="")) returned 0 [0093.818] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0093.818] GetProcessHeap () returned 0x840000 [0093.818] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.818] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0093.818] GetProcessHeap () returned 0x840000 [0093.818] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.823] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.TUR", cAlternateFileName="ACCESS~1.TUR")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x61200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.TUR", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.TUR", cAlternateFileName="ADOBEC~1.TUR")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.TUR", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820a1b60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.TUR", cAlternateFileName="BRDLAN~1.TUR")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.TUR", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.TUR", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.TUR", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.TUR", cAlternateFileName="")) returned 1 [0093.824] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.TUR", cAlternateFileName="MAKEAC~1.TUR")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.TUR", cAlternateFileName="MULTIM~1.TUR")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7a400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807571a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.TUR", cAlternateFileName="READOU~1.TUR")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reflow.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.TUR", cAlternateFileName="SAVEAS~1.TUR")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.TUR", cAlternateFileName="")) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.825] GetProcessHeap () returned 0x840000 [0093.825] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0093.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0093.828] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.828] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9270, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.828] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.828] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.829] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0093.829] GetProcessHeap () returned 0x840000 [0093.829] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0093.829] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.TUR", cAlternateFileName="")) returned 1 [0093.829] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.TUR", cAlternateFileName="")) returned 1 [0093.829] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.TUR", cAlternateFileName="")) returned 1 [0093.829] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830ff2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.TUR", cAlternateFileName="")) returned 0 [0093.829] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.829] GetProcessHeap () returned 0x840000 [0093.829] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.830] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0093.830] GetProcessHeap () returned 0x840000 [0093.830] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.833] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.UKR", cAlternateFileName="ACCESS~1.UKR")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x65600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.UKR", cAlternateFileName="ADOBEC~1.UKR")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820a1b60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.UKR", cAlternateFileName="BRDLAN~1.UKR")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.UKR", cAlternateFileName="")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.UKR", cAlternateFileName="MAKEAC~1.UKR")) returned 1 [0093.834] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.UKR", cAlternateFileName="MULTIM~1.UKR")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.UKR", cAlternateFileName="")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.UKR", cAlternateFileName="")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807571a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.UKR", cAlternateFileName="")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.UKR", cAlternateFileName="READOU~1.UKR")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reflow.UKR", cAlternateFileName="")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.UKR", cAlternateFileName="SAVEAS~1.UKR")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830b2fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.UKR", cAlternateFileName="")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.UKR", cAlternateFileName="")) returned 1 [0093.835] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.835] GetProcessHeap () returned 0x840000 [0093.835] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0093.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0093.836] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.836] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.836] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.836] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.837] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0093.837] GetProcessHeap () returned 0x840000 [0093.837] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0093.837] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.UKR", cAlternateFileName="")) returned 1 [0093.837] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.UKR", cAlternateFileName="")) returned 1 [0093.837] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.UKR", cAlternateFileName="")) returned 1 [0093.837] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.UKR", cAlternateFileName="")) returned 0 [0093.837] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.837] GetProcessHeap () returned 0x840000 [0093.837] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.838] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0093.838] GetProcessHeap () returned 0x840000 [0093.838] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CHS", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CHS", cAlternateFileName="ADOBEC~1.CHS")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CHS", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CHS", cAlternateFileName="BRDLAN~1.CHS")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CHS", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CHS", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CHS", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CHS", cAlternateFileName="")) returned 1 [0093.916] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CHS", cAlternateFileName="MAKEAC~1.CHS")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CHS", cAlternateFileName="MULTIM~1.CHS")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CHS", cAlternateFileName="READOU~1.CHS")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CHS", cAlternateFileName="SAVEAS~1.CHS")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CHS", cAlternateFileName="")) returned 1 [0093.917] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.917] GetProcessHeap () returned 0x840000 [0093.917] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0093.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0093.952] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.952] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0093.953] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0093.953] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0093.953] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0093.953] GetProcessHeap () returned 0x840000 [0093.953] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0093.953] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0093.953] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CHS", cAlternateFileName="")) returned 1 [0093.953] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.CHS", cAlternateFileName="")) returned 1 [0093.953] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.CHS", cAlternateFileName="")) returned 0 [0093.953] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0093.954] GetProcessHeap () returned 0x840000 [0093.954] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0093.959] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0093.962] GetProcessHeap () returned 0x840000 [0093.962] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0093.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.011] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.011] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0094.011] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CHT", cAlternateFileName="ADOBEC~1.CHT")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CHT", cAlternateFileName="BRDLAN~1.CHT")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CHT", cAlternateFileName="MAKEAC~1.CHT")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xda00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CHT", cAlternateFileName="MULTIM~1.CHT")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe0e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CHT", cAlternateFileName="")) returned 1 [0094.012] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CHT", cAlternateFileName="READOU~1.CHT")) returned 1 [0094.013] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CHT", cAlternateFileName="")) returned 1 [0094.013] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CHT", cAlternateFileName="SAVEAS~1.CHT")) returned 1 [0094.013] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CHT", cAlternateFileName="")) returned 1 [0094.013] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CHT", cAlternateFileName="")) returned 1 [0094.013] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0094.013] GetProcessHeap () returned 0x840000 [0094.013] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0094.013] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.013] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0094.014] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0094.014] GetProcessHeap () returned 0x840000 [0094.014] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.014] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.014] GetProcessHeap () returned 0x840000 [0094.014] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0094.014] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0094.014] GetProcessHeap () returned 0x840000 [0094.014] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0094.014] GetProcessHeap () returned 0x840000 [0094.014] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0094.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0094.015] GetProcessHeap () returned 0x840000 [0094.015] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0094.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.016] GetProcessHeap () returned 0x840000 [0094.016] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0094.016] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0094.017] GetProcessHeap () returned 0x840000 [0094.017] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.017] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.017] GetProcessHeap () returned 0x840000 [0094.017] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0094.017] GetProcessHeap () returned 0x840000 [0094.017] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0094.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.018] GetProcessHeap () returned 0x840000 [0094.018] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0094.019] GetProcessHeap () returned 0x840000 [0094.019] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.022] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.023] GetProcessHeap () returned 0x840000 [0094.023] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.023] GetProcessHeap () returned 0x840000 [0094.023] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.023] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.024] GetProcessHeap () returned 0x840000 [0094.024] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.024] GetProcessHeap () returned 0x840000 [0094.024] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.024] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.024] GetProcessHeap () returned 0x840000 [0094.024] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.024] GetProcessHeap () returned 0x840000 [0094.025] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.026] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.027] GetProcessHeap () returned 0x840000 [0094.027] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.027] GetProcessHeap () returned 0x840000 [0094.027] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.028] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.028] GetProcessHeap () returned 0x840000 [0094.028] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.028] GetProcessHeap () returned 0x840000 [0094.028] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.029] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.029] GetProcessHeap () returned 0x840000 [0094.029] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.029] GetProcessHeap () returned 0x840000 [0094.029] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.029] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.030] GetProcessHeap () returned 0x840000 [0094.030] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.030] GetProcessHeap () returned 0x840000 [0094.030] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.030] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.030] GetProcessHeap () returned 0x840000 [0094.030] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.030] GetProcessHeap () returned 0x840000 [0094.030] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.032] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.033] GetProcessHeap () returned 0x840000 [0094.033] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.033] GetProcessHeap () returned 0x840000 [0094.033] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.034] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.035] GetProcessHeap () returned 0x840000 [0094.035] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.035] GetProcessHeap () returned 0x840000 [0094.035] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.037] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.037] GetProcessHeap () returned 0x840000 [0094.037] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.037] GetProcessHeap () returned 0x840000 [0094.037] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.056] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.057] GetProcessHeap () returned 0x840000 [0094.057] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.057] GetProcessHeap () returned 0x840000 [0094.057] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.059] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.059] GetProcessHeap () returned 0x840000 [0094.059] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.059] GetProcessHeap () returned 0x840000 [0094.059] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.063] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.063] GetProcessHeap () returned 0x840000 [0094.063] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.063] GetProcessHeap () returned 0x840000 [0094.063] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.065] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.065] GetProcessHeap () returned 0x840000 [0094.065] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.065] GetProcessHeap () returned 0x840000 [0094.065] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.066] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.066] GetProcessHeap () returned 0x840000 [0094.067] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.067] GetProcessHeap () returned 0x840000 [0094.067] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.070] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.070] GetProcessHeap () returned 0x840000 [0094.070] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.070] GetProcessHeap () returned 0x840000 [0094.070] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.160] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.162] GetProcessHeap () returned 0x840000 [0094.162] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.167] GetProcessHeap () returned 0x840000 [0094.167] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.346] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.346] GetProcessHeap () returned 0x840000 [0094.346] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.346] GetProcessHeap () returned 0x840000 [0094.346] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.356] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.357] GetProcessHeap () returned 0x840000 [0094.357] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.357] GetProcessHeap () returned 0x840000 [0094.357] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.363] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.364] GetProcessHeap () returned 0x840000 [0094.364] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.364] GetProcessHeap () returned 0x840000 [0094.364] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.372] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.373] GetProcessHeap () returned 0x840000 [0094.373] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.373] GetProcessHeap () returned 0x840000 [0094.373] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.379] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.379] GetProcessHeap () returned 0x840000 [0094.379] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.379] GetProcessHeap () returned 0x840000 [0094.379] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.380] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.380] GetProcessHeap () returned 0x840000 [0094.380] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.380] GetProcessHeap () returned 0x840000 [0094.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.381] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.381] GetProcessHeap () returned 0x840000 [0094.381] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.382] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0094.382] GetProcessHeap () returned 0x840000 [0094.382] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x992b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0094.385] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0094.386] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0094.386] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.386] GetProcessHeap () returned 0x840000 [0094.386] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.386] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0094.386] GetProcessHeap () returned 0x840000 [0094.386] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.527] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.527] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0094.527] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0094.527] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0094.528] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb189, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0094.528] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0094.528] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0094.528] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0094.528] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.528] GetProcessHeap () returned 0x840000 [0094.528] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.529] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0094.529] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 0 [0094.529] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0094.529] GetProcessHeap () returned 0x840000 [0094.529] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.530] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0094.530] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.530] GetProcessHeap () returned 0x840000 [0094.530] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15de63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd063, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ab863, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18463, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.api", cAlternateFileName="")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x234a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1 [0094.531] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1 [0094.531] GetProcessHeap () returned 0x840000 [0094.531] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0094.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0094.566] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.566] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0094.567] GetProcessHeap () returned 0x840000 [0094.567] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0094.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0094.615] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.622] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0094.622] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CHS", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CHT", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.DAN", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.DEU", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.ESP", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.EUQ", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.FRA", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.ITA", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.JPN", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.KOR", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.mpp", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6b1000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.NLD", cAlternateFileName="")) returned 1 [0094.623] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.NOR", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.PTB", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SUO", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SVE", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.CAT", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.CHS", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.CHT", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.DAN", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.DEU", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.ESP", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.EUQ", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.FRA", cAlternateFileName="")) returned 1 [0094.624] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.ITA", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.JPN", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.KOR", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.mpp", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.NLD", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.NOR", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.PTB", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.SUO", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.SVE", cAlternateFileName="")) returned 1 [0094.625] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CAT", cAlternateFileName="QUICKT~1.CAT")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CHS", cAlternateFileName="QUICKT~1.CHS")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CHT", cAlternateFileName="QUICKT~1.CHT")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.DAN", cAlternateFileName="QUICKT~1.DAN")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.DEU", cAlternateFileName="QUICKT~1.DEU")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.ESP", cAlternateFileName="QUICKT~1.ESP")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.EUQ", cAlternateFileName="QUICKT~1.EUQ")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.FRA", cAlternateFileName="QUICKT~1.FRA")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.ITA", cAlternateFileName="QUICKT~1.ITA")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.JPN", cAlternateFileName="QUICKT~1.JPN")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.KOR", cAlternateFileName="QUICKT~1.KOR")) returned 1 [0094.700] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44000, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.mpp", cAlternateFileName="QUICKT~1.MPP")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.NLD", cAlternateFileName="QUICKT~1.NLD")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.NOR", cAlternateFileName="QUICKT~1.NOR")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.PTB", cAlternateFileName="QUICKT~1.PTB")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SUO", cAlternateFileName="QUICKT~1.SUO")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SVE", cAlternateFileName="QUICKT~1.SVE")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CAT", cAlternateFileName="WINDOW~1.CAT")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CHS", cAlternateFileName="WINDOW~1.CHS")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CHT", cAlternateFileName="WINDOW~1.CHT")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.DAN", cAlternateFileName="WINDOW~1.DAN")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.DEU", cAlternateFileName="WINDOW~1.DEU")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.ESP", cAlternateFileName="WINDOW~1.ESP")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.EUQ", cAlternateFileName="WINDOW~1.EUQ")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.FRA", cAlternateFileName="WINDOW~1.FRA")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.ITA", cAlternateFileName="WINDOW~1.ITA")) returned 1 [0094.701] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.JPN", cAlternateFileName="WINDOW~1.JPN")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.KOR", cAlternateFileName="WINDOW~1.KOR")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.NLD", cAlternateFileName="WINDOW~1.NLD")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.NOR", cAlternateFileName="WINDOW~1.NOR")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.PTB", cAlternateFileName="WINDOW~1.PTB")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SUO", cAlternateFileName="WINDOW~1.SUO")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 1 [0094.702] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 0 [0094.702] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0094.703] GetProcessHeap () returned 0x840000 [0094.703] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0094.703] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0094.703] GetProcessHeap () returned 0x840000 [0094.703] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0094.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0094.708] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.708] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0094.743] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.CZE", cAlternateFileName="")) returned 1 [0094.743] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CZE", cAlternateFileName="QUICKT~1.CZE")) returned 1 [0094.743] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 1 [0094.743] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 0 [0094.743] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0094.744] GetProcessHeap () returned 0x840000 [0094.744] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0094.744] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0094.744] GetProcessHeap () returned 0x840000 [0094.744] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0094.749] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.749] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0094.749] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.HRV", cAlternateFileName="")) returned 1 [0094.749] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.HRV", cAlternateFileName="QUICKT~1.HRV")) returned 1 [0094.749] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 1 [0094.749] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 0 [0094.749] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0094.749] GetProcessHeap () returned 0x840000 [0094.749] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.749] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0094.749] GetProcessHeap () returned 0x840000 [0094.749] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0094.753] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.753] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0094.754] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.HUN", cAlternateFileName="")) returned 1 [0094.754] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.HUN", cAlternateFileName="QUICKT~1.HUN")) returned 1 [0094.754] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 1 [0094.754] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 0 [0094.754] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0094.754] GetProcessHeap () returned 0x840000 [0094.754] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.754] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0094.754] GetProcessHeap () returned 0x840000 [0094.754] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0094.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.789] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.789] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0094.789] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.POL", cAlternateFileName="")) returned 1 [0094.789] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.POL", cAlternateFileName="QUICKT~1.POL")) returned 1 [0094.789] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 1 [0094.789] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 0 [0094.789] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.789] GetProcessHeap () returned 0x840000 [0094.789] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0094.790] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0094.790] GetProcessHeap () returned 0x840000 [0094.790] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.803] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.804] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0094.836] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.RUM", cAlternateFileName="")) returned 1 [0094.836] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.RUM", cAlternateFileName="QUICKT~1.RUM")) returned 1 [0094.836] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 1 [0094.836] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 0 [0094.836] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.836] GetProcessHeap () returned 0x840000 [0094.836] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.837] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0094.837] GetProcessHeap () returned 0x840000 [0094.837] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.847] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.847] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0094.847] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.RUS", cAlternateFileName="")) returned 1 [0094.847] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.RUS", cAlternateFileName="QUICKT~1.RUS")) returned 1 [0094.847] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 1 [0094.847] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 0 [0094.847] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.847] GetProcessHeap () returned 0x840000 [0094.847] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.847] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0094.848] GetProcessHeap () returned 0x840000 [0094.848] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.853] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.853] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0094.853] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.SKY", cAlternateFileName="")) returned 1 [0094.853] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SKY", cAlternateFileName="QUICKT~1.SKY")) returned 1 [0094.853] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 1 [0094.853] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 0 [0094.853] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.853] GetProcessHeap () returned 0x840000 [0094.853] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.853] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0094.853] GetProcessHeap () returned 0x840000 [0094.853] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.907] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.907] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0094.907] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.SLV", cAlternateFileName="")) returned 1 [0094.907] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SLV", cAlternateFileName="QUICKT~1.SLV")) returned 1 [0094.907] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 1 [0094.907] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 0 [0094.907] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.907] GetProcessHeap () returned 0x840000 [0094.907] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.907] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0094.907] GetProcessHeap () returned 0x840000 [0094.908] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.958] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.958] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0094.958] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.TUR", cAlternateFileName="")) returned 1 [0094.958] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.TUR", cAlternateFileName="QUICKT~1.TUR")) returned 1 [0094.958] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 1 [0094.959] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 0 [0094.959] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.959] GetProcessHeap () returned 0x840000 [0094.959] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.959] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0094.959] GetProcessHeap () returned 0x840000 [0094.959] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0094.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0094.981] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.981] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0094.981] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.UKR", cAlternateFileName="")) returned 1 [0094.981] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.UKR", cAlternateFileName="QUICKT~1.UKR")) returned 1 [0094.981] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 1 [0094.981] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 0 [0094.982] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0094.982] GetProcessHeap () returned 0x840000 [0094.982] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0094.982] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0094.982] GetProcessHeap () returned 0x840000 [0094.982] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.api", cAlternateFileName="")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73f263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b663, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x54e63, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.api", cAlternateFileName="")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63263, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69063, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.api", cAlternateFileName="")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.api", cAlternateFileName="")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.api", cAlternateFileName="")) returned 1 [0094.982] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x29463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.api", cAlternateFileName="")) returned 1 [0094.983] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 1 [0094.983] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 0 [0094.983] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0094.983] GetProcessHeap () returned 0x840000 [0094.983] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0094.983] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0094.983] GetProcessHeap () returned 0x840000 [0094.983] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0094.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.017] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.017] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0095.017] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="3difr.x3d", cAlternateFileName="")) returned 1 [0095.017] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX8.x3d", cAlternateFileName="")) returned 1 [0095.018] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc6f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1 [0095.018] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35190, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1 [0095.018] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prc", cAlternateFileName="")) returned 1 [0095.018] GetProcessHeap () returned 0x840000 [0095.018] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0095.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0095.024] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.024] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 0 [0095.025] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0095.025] GetProcessHeap () returned 0x840000 [0095.025] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0 [0095.025] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.025] GetProcessHeap () returned 0x840000 [0095.025] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1 [0095.025] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0095.025] GetProcessHeap () returned 0x840000 [0095.025] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.034] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.034] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.spi", cAlternateFileName="")) returned 1 [0095.034] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 1 [0095.034] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 0 [0095.034] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.034] GetProcessHeap () returned 0x840000 [0095.034] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.034] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPPlugins", cAlternateFileName="SPPLUG~1")) returned 1 [0095.034] GetProcessHeap () returned 0x840000 [0095.034] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.041] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.041] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 1 [0095.041] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 0 [0095.041] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.041] GetProcessHeap () returned 0x840000 [0095.041] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.041] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite.dll", cAlternateFileName="")) returned 1 [0095.041] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1 [0095.041] GetProcessHeap () returned 0x840000 [0095.041] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.049] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="bl.gif", cAlternateFileName="")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="br.gif", cAlternateFileName="")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_all.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1 [0095.054] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_received.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_super.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.gif", cAlternateFileName="")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdf.gif", cAlternateFileName="")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviewers.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_browser.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_same_reviewers.gif", cAlternateFileName="RE78D9~1.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_shared.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss.gif", cAlternateFileName="")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_issue.gif", cAlternateFileName="SERVER~3.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_lg.gif", cAlternateFileName="SERVER~1.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_ok.gif", cAlternateFileName="SERVER~2.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x0, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="tl.gif", cAlternateFileName="")) returned 1 [0095.056] FindNextFileW (in: hFindFile=0x937c18, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr.gif", cAlternateFileName="")) returned 1 [0095.057] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.058] GetProcessHeap () returned 0x840000 [0095.058] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.058] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.058] GetProcessHeap () returned 0x840000 [0095.058] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.059] GetProcessHeap () returned 0x840000 [0095.059] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.114] GetProcessHeap () returned 0x840000 [0095.114] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.118] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.118] GetProcessHeap () returned 0x840000 [0095.118] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.118] GetProcessHeap () returned 0x840000 [0095.118] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.127] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.128] GetProcessHeap () returned 0x840000 [0095.128] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.128] GetProcessHeap () returned 0x840000 [0095.128] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.149] GetProcessHeap () returned 0x840000 [0095.149] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0095.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0095.150] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0095.150] GetProcessHeap () returned 0x840000 [0095.150] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0095.150] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.150] GetProcessHeap () returned 0x840000 [0095.150] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.150] GetProcessHeap () returned 0x840000 [0095.150] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.151] GetProcessHeap () returned 0x840000 [0095.151] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0095.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0095.287] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0095.288] GetProcessHeap () returned 0x840000 [0095.288] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0095.288] GetProcessHeap () returned 0x840000 [0095.288] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0095.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0095.289] GetProcessHeap () returned 0x840000 [0095.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0095.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0095.289] GetProcessHeap () returned 0x840000 [0095.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0095.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0095.367] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0095.368] GetProcessHeap () returned 0x840000 [0095.368] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0095.368] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0095.368] GetProcessHeap () returned 0x840000 [0095.368] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0095.370] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0095.370] GetProcessHeap () returned 0x840000 [0095.370] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0095.370] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.370] GetProcessHeap () returned 0x840000 [0095.370] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.370] GetProcessHeap () returned 0x840000 [0095.370] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.371] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.371] GetProcessHeap () returned 0x840000 [0095.371] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.371] GetProcessHeap () returned 0x840000 [0095.371] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.379] GetProcessHeap () returned 0x840000 [0095.379] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2ae0050 [0095.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0095.379] GetProcessHeap () returned 0x840000 [0095.379] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0095.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0095.380] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0095.380] GetProcessHeap () returned 0x840000 [0095.380] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0095.380] GetProcessHeap () returned 0x840000 [0095.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0095.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0095.381] GetProcessHeap () returned 0x840000 [0095.381] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0095.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0095.384] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0095.384] GetProcessHeap () returned 0x840000 [0095.384] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0095.384] GetProcessHeap () returned 0x840000 [0095.384] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0095.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0095.396] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0095.430] GetProcessHeap () returned 0x840000 [0095.430] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0095.430] GetProcessHeap () returned 0x840000 [0095.430] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0095.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0095.490] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0095.491] GetProcessHeap () returned 0x840000 [0095.491] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0095.491] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0095.491] GetProcessHeap () returned 0x840000 [0095.491] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0095.492] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0095.493] GetProcessHeap () returned 0x840000 [0095.493] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2ae0050 | out: hHeap=0x840000) returned 1 [0095.493] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.493] GetProcessHeap () returned 0x840000 [0095.493] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.493] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.493] GetProcessHeap () returned 0x840000 [0095.493] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.494] GetProcessHeap () returned 0x840000 [0095.494] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.495] GetProcessHeap () returned 0x840000 [0095.495] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.519] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.520] GetProcessHeap () returned 0x840000 [0095.520] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.520] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.520] GetProcessHeap () returned 0x840000 [0095.520] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.520] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0095.520] GetProcessHeap () returned 0x840000 [0095.520] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0095.521] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0095.521] GetProcessHeap () returned 0x840000 [0095.521] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0095.522] GetProcessHeap () returned 0x840000 [0095.522] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0095.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0095.522] GetProcessHeap () returned 0x840000 [0095.522] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0095.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0095.523] GetProcessHeap () returned 0x840000 [0095.523] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.523] GetProcessHeap () returned 0x840000 [0095.523] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.558] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.558] GetProcessHeap () returned 0x840000 [0095.558] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.558] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.559] GetProcessHeap () returned 0x840000 [0095.559] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.559] GetProcessHeap () returned 0x840000 [0095.559] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.559] GetProcessHeap () returned 0x840000 [0095.559] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.559] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.559] GetProcessHeap () returned 0x840000 [0095.559] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.559] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.559] GetProcessHeap () returned 0x840000 [0095.559] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.559] GetProcessHeap () returned 0x840000 [0095.559] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.577] GetProcessHeap () returned 0x840000 [0095.577] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.634] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.634] GetProcessHeap () returned 0x840000 [0095.634] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.634] GetProcessHeap () returned 0x840000 [0095.634] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.658] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.658] GetProcessHeap () returned 0x840000 [0095.658] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.659] GetProcessHeap () returned 0x840000 [0095.659] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.677] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.677] GetProcessHeap () returned 0x840000 [0095.678] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.678] GetProcessHeap () returned 0x840000 [0095.678] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.724] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.724] GetProcessHeap () returned 0x840000 [0095.724] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.724] GetProcessHeap () returned 0x840000 [0095.724] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.725] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.725] GetProcessHeap () returned 0x840000 [0095.725] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.725] GetProcessHeap () returned 0x840000 [0095.725] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.750] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.750] GetProcessHeap () returned 0x840000 [0095.750] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.750] GetProcessHeap () returned 0x840000 [0095.750] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.751] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.751] GetProcessHeap () returned 0x840000 [0095.751] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.751] GetProcessHeap () returned 0x840000 [0095.751] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.757] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.757] GetProcessHeap () returned 0x840000 [0095.757] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.757] GetProcessHeap () returned 0x840000 [0095.757] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.763] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.763] GetProcessHeap () returned 0x840000 [0095.763] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.763] GetProcessHeap () returned 0x840000 [0095.763] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.763] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.763] GetProcessHeap () returned 0x840000 [0095.763] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.763] GetProcessHeap () returned 0x840000 [0095.763] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.769] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.769] GetProcessHeap () returned 0x840000 [0095.769] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.769] GetProcessHeap () returned 0x840000 [0095.769] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.775] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.775] GetProcessHeap () returned 0x840000 [0095.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.775] GetProcessHeap () returned 0x840000 [0095.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.775] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.775] GetProcessHeap () returned 0x840000 [0095.775] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.775] GetProcessHeap () returned 0x840000 [0095.775] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.779] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.779] GetProcessHeap () returned 0x840000 [0095.779] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.779] GetProcessHeap () returned 0x840000 [0095.779] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.779] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.779] GetProcessHeap () returned 0x840000 [0095.779] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.779] GetProcessHeap () returned 0x840000 [0095.779] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.780] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.780] GetProcessHeap () returned 0x840000 [0095.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.780] GetProcessHeap () returned 0x840000 [0095.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.780] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.780] GetProcessHeap () returned 0x840000 [0095.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.780] GetProcessHeap () returned 0x840000 [0095.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.780] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.780] GetProcessHeap () returned 0x840000 [0095.780] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.780] GetProcessHeap () returned 0x840000 [0095.780] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.831] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.831] GetProcessHeap () returned 0x840000 [0095.831] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.831] GetProcessHeap () returned 0x840000 [0095.831] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.831] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.831] GetProcessHeap () returned 0x840000 [0095.831] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.831] GetProcessHeap () returned 0x840000 [0095.831] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.838] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.838] GetProcessHeap () returned 0x840000 [0095.838] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.838] GetProcessHeap () returned 0x840000 [0095.838] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.839] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.839] GetProcessHeap () returned 0x840000 [0095.839] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.839] GetProcessHeap () returned 0x840000 [0095.839] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.839] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.839] GetProcessHeap () returned 0x840000 [0095.839] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.839] GetProcessHeap () returned 0x840000 [0095.839] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.843] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.843] GetProcessHeap () returned 0x840000 [0095.843] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.843] GetProcessHeap () returned 0x840000 [0095.843] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.843] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.843] GetProcessHeap () returned 0x840000 [0095.843] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.843] GetProcessHeap () returned 0x840000 [0095.843] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.844] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.844] GetProcessHeap () returned 0x840000 [0095.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.844] GetProcessHeap () returned 0x840000 [0095.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.844] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.844] GetProcessHeap () returned 0x840000 [0095.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.844] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.844] GetProcessHeap () returned 0x840000 [0095.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.844] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0095.844] GetProcessHeap () returned 0x840000 [0095.844] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0095.844] GetProcessHeap () returned 0x840000 [0095.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0095.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0095.845] GetProcessHeap () returned 0x840000 [0095.845] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.846] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.846] GetProcessHeap () returned 0x840000 [0095.846] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.846] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0095.846] GetProcessHeap () returned 0x840000 [0095.846] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0095.846] GetProcessHeap () returned 0x840000 [0095.846] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0095.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0095.847] GetProcessHeap () returned 0x840000 [0095.847] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.847] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0095.847] GetProcessHeap () returned 0x840000 [0095.847] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0095.847] GetProcessHeap () returned 0x840000 [0095.847] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0095.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0095.954] GetProcessHeap () returned 0x840000 [0095.954] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.964] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.964] GetProcessHeap () returned 0x840000 [0095.964] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.964] GetProcessHeap () returned 0x840000 [0095.964] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.964] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.964] GetProcessHeap () returned 0x840000 [0095.964] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.964] GetProcessHeap () returned 0x840000 [0095.964] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.972] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.972] GetProcessHeap () returned 0x840000 [0095.972] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.972] GetProcessHeap () returned 0x840000 [0095.972] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.975] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.975] GetProcessHeap () returned 0x840000 [0095.975] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.975] GetProcessHeap () returned 0x840000 [0095.975] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.975] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.975] GetProcessHeap () returned 0x840000 [0095.975] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.975] GetProcessHeap () returned 0x840000 [0095.975] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.978] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.978] GetProcessHeap () returned 0x840000 [0095.978] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.978] GetProcessHeap () returned 0x840000 [0095.978] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0095.978] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0095.979] GetProcessHeap () returned 0x840000 [0095.979] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0095.979] GetProcessHeap () returned 0x840000 [0095.979] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0095.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.018] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.018] GetProcessHeap () returned 0x840000 [0096.018] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.018] GetProcessHeap () returned 0x840000 [0096.018] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.019] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.019] GetProcessHeap () returned 0x840000 [0096.019] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.019] GetProcessHeap () returned 0x840000 [0096.019] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.019] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.019] GetProcessHeap () returned 0x840000 [0096.019] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.019] GetProcessHeap () returned 0x840000 [0096.019] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.019] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.020] GetProcessHeap () returned 0x840000 [0096.020] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.020] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.020] GetProcessHeap () returned 0x840000 [0096.020] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.020] GetProcessHeap () returned 0x840000 [0096.020] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.032] GetProcessHeap () returned 0x840000 [0096.032] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.034] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.035] GetProcessHeap () returned 0x840000 [0096.035] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.035] GetProcessHeap () returned 0x840000 [0096.035] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.035] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.035] GetProcessHeap () returned 0x840000 [0096.035] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.035] GetProcessHeap () returned 0x840000 [0096.035] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.039] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.039] GetProcessHeap () returned 0x840000 [0096.039] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.039] GetProcessHeap () returned 0x840000 [0096.039] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.040] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.040] GetProcessHeap () returned 0x840000 [0096.040] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.040] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.040] GetProcessHeap () returned 0x840000 [0096.040] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.040] GetProcessHeap () returned 0x840000 [0096.040] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.056] GetProcessHeap () returned 0x840000 [0096.056] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.112] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.112] GetProcessHeap () returned 0x840000 [0096.112] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.112] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.112] GetProcessHeap () returned 0x840000 [0096.113] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.113] GetProcessHeap () returned 0x840000 [0096.113] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.254] GetProcessHeap () returned 0x840000 [0096.254] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.255] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.255] GetProcessHeap () returned 0x840000 [0096.255] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.255] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.255] GetProcessHeap () returned 0x840000 [0096.255] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.255] GetProcessHeap () returned 0x840000 [0096.255] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.255] GetProcessHeap () returned 0x840000 [0096.256] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.276] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.276] GetProcessHeap () returned 0x840000 [0096.276] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.276] GetProcessHeap () returned 0x840000 [0096.276] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.276] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.276] GetProcessHeap () returned 0x840000 [0096.276] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.276] GetProcessHeap () returned 0x840000 [0096.276] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.277] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.277] GetProcessHeap () returned 0x840000 [0096.277] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.277] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.277] GetProcessHeap () returned 0x840000 [0096.277] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.277] GetProcessHeap () returned 0x840000 [0096.277] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.333] GetProcessHeap () returned 0x840000 [0096.333] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c18 [0096.333] FindClose (in: hFindFile=0x937c18 | out: hFindFile=0x937c18) returned 1 [0096.333] GetProcessHeap () returned 0x840000 [0096.333] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.333] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.333] GetProcessHeap () returned 0x840000 [0096.333] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.333] GetProcessHeap () returned 0x840000 [0096.333] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.354] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.355] GetProcessHeap () returned 0x840000 [0096.355] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.355] GetProcessHeap () returned 0x840000 [0096.355] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.365] GetProcessHeap () returned 0x840000 [0096.365] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.377] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.377] GetProcessHeap () returned 0x840000 [0096.377] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.377] GetProcessHeap () returned 0x840000 [0096.377] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.379] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.379] GetProcessHeap () returned 0x840000 [0096.379] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.379] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.379] GetProcessHeap () returned 0x840000 [0096.379] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.379] GetProcessHeap () returned 0x840000 [0096.379] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.380] GetProcessHeap () returned 0x840000 [0096.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.380] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.380] GetProcessHeap () returned 0x840000 [0096.380] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.380] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.380] GetProcessHeap () returned 0x840000 [0096.380] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.380] GetProcessHeap () returned 0x840000 [0096.380] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.386] GetProcessHeap () returned 0x840000 [0096.386] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.386] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.386] GetProcessHeap () returned 0x840000 [0096.386] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.386] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.386] GetProcessHeap () returned 0x840000 [0096.387] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.387] GetProcessHeap () returned 0x840000 [0096.387] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.391] GetProcessHeap () returned 0x840000 [0096.391] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.394] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.394] GetProcessHeap () returned 0x840000 [0096.394] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.394] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.394] GetProcessHeap () returned 0x840000 [0096.394] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.394] GetProcessHeap () returned 0x840000 [0096.394] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.394] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.394] GetProcessHeap () returned 0x840000 [0096.394] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.395] GetProcessHeap () returned 0x840000 [0096.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.395] GetProcessHeap () returned 0x840000 [0096.395] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.440] GetProcessHeap () returned 0x840000 [0096.440] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.456] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.457] GetProcessHeap () returned 0x840000 [0096.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.457] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.457] GetProcessHeap () returned 0x840000 [0096.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.457] GetProcessHeap () returned 0x840000 [0096.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.457] GetProcessHeap () returned 0x840000 [0096.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.458] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.458] GetProcessHeap () returned 0x840000 [0096.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.458] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.458] GetProcessHeap () returned 0x840000 [0096.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.458] GetProcessHeap () returned 0x840000 [0096.458] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.458] GetProcessHeap () returned 0x840000 [0096.458] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.459] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.460] GetProcessHeap () returned 0x840000 [0096.460] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.460] GetProcessHeap () returned 0x840000 [0096.460] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69acfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.460] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.461] GetProcessHeap () returned 0x840000 [0096.461] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.461] GetProcessHeap () returned 0x840000 [0096.461] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52328bf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.462] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.463] GetProcessHeap () returned 0x840000 [0096.463] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.463] GetProcessHeap () returned 0x840000 [0096.463] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583906f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60f4a00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.464] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.464] GetProcessHeap () returned 0x840000 [0096.464] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.464] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.464] GetProcessHeap () returned 0x840000 [0096.464] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.464] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.465] GetProcessHeap () returned 0x840000 [0096.465] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.465] GetProcessHeap () returned 0x840000 [0096.465] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.468] GetProcessHeap () returned 0x840000 [0096.468] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.502] GetProcessHeap () returned 0x840000 [0096.502] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.552] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.552] GetProcessHeap () returned 0x840000 [0096.553] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.553] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.553] GetProcessHeap () returned 0x840000 [0096.553] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.553] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.553] GetProcessHeap () returned 0x840000 [0096.553] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.553] GetProcessHeap () returned 0x840000 [0096.553] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.553] GetProcessHeap () returned 0x840000 [0096.553] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.554] GetProcessHeap () returned 0x840000 [0096.554] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.573] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.573] GetProcessHeap () returned 0x840000 [0096.573] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.573] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.573] GetProcessHeap () returned 0x840000 [0096.573] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.573] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.573] GetProcessHeap () returned 0x840000 [0096.573] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.573] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.573] GetProcessHeap () returned 0x840000 [0096.573] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.574] GetProcessHeap () returned 0x840000 [0096.574] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.582] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.582] GetProcessHeap () returned 0x840000 [0096.582] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.582] GetProcessHeap () returned 0x840000 [0096.582] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.582] GetProcessHeap () returned 0x840000 [0096.582] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.583] GetProcessHeap () returned 0x840000 [0096.583] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.583] GetProcessHeap () returned 0x840000 [0096.583] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.615] GetProcessHeap () returned 0x840000 [0096.615] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0096.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0096.619] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0096.620] GetProcessHeap () returned 0x840000 [0096.620] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0096.620] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.621] GetProcessHeap () returned 0x840000 [0096.621] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.622] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.622] GetProcessHeap () returned 0x840000 [0096.622] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.622] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.622] GetProcessHeap () returned 0x840000 [0096.622] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.623] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.623] GetProcessHeap () returned 0x840000 [0096.623] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.624] GetProcessHeap () returned 0x840000 [0096.624] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.628] GetProcessHeap () returned 0x840000 [0096.628] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\ado\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.631] GetProcessHeap () returned 0x840000 [0096.632] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.634] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.634] GetProcessHeap () returned 0x840000 [0096.634] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.634] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.634] GetProcessHeap () returned 0x840000 [0096.634] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.634] GetProcessHeap () returned 0x840000 [0096.634] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\en-US\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.635] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.635] GetProcessHeap () returned 0x840000 [0096.635] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.635] GetProcessHeap () returned 0x840000 [0096.635] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\msadc\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.650] GetProcessHeap () returned 0x840000 [0096.650] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.652] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.652] GetProcessHeap () returned 0x840000 [0096.652] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.652] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.653] GetProcessHeap () returned 0x840000 [0096.653] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.653] GetProcessHeap () returned 0x840000 [0096.653] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.783] GetProcessHeap () returned 0x840000 [0096.783] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.783] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.783] GetProcessHeap () returned 0x840000 [0096.783] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.784] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.784] GetProcessHeap () returned 0x840000 [0096.784] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.784] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.784] GetProcessHeap () returned 0x840000 [0096.784] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.785] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0096.785] GetProcessHeap () returned 0x840000 [0096.785] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0096.785] GetProcessHeap () returned 0x840000 [0096.785] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0096.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x76888300, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76888300, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0096.785] GetProcessHeap () returned 0x840000 [0096.785] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.786] GetProcessHeap () returned 0x840000 [0096.786] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.787] GetProcessHeap () returned 0x840000 [0096.787] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.805] GetProcessHeap () returned 0x840000 [0096.805] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.817] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.818] GetProcessHeap () returned 0x840000 [0096.818] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.818] GetProcessHeap () returned 0x840000 [0096.818] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.821] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.821] GetProcessHeap () returned 0x840000 [0096.821] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.821] GetProcessHeap () returned 0x840000 [0096.821] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.821] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.822] GetProcessHeap () returned 0x840000 [0096.822] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.822] GetProcessHeap () returned 0x840000 [0096.822] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.856] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.857] GetProcessHeap () returned 0x840000 [0096.857] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.857] GetProcessHeap () returned 0x840000 [0096.857] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.877] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.877] GetProcessHeap () returned 0x840000 [0096.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.878] GetProcessHeap () returned 0x840000 [0096.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0096.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0096.878] GetProcessHeap () returned 0x840000 [0096.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0096.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0096.879] GetProcessHeap () returned 0x840000 [0096.879] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0096.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0096.940] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0096.941] GetProcessHeap () returned 0x840000 [0096.941] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0096.941] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0096.941] GetProcessHeap () returned 0x840000 [0096.941] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0096.941] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0096.941] GetProcessHeap () returned 0x840000 [0096.941] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0096.942] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.942] GetProcessHeap () returned 0x840000 [0096.942] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.943] GetProcessHeap () returned 0x840000 [0096.943] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0096.943] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0096.943] GetProcessHeap () returned 0x840000 [0096.943] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0096.943] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0096.943] GetProcessHeap () returned 0x840000 [0096.943] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0096.944] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.944] GetProcessHeap () returned 0x840000 [0096.944] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.945] GetProcessHeap () returned 0x840000 [0096.945] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.945] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.945] GetProcessHeap () returned 0x840000 [0096.945] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.946] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0096.946] GetProcessHeap () returned 0x840000 [0096.946] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0096.946] GetProcessHeap () returned 0x840000 [0096.946] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0096.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x768d45c0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768d45c0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0096.946] GetProcessHeap () returned 0x840000 [0096.946] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.946] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.946] GetProcessHeap () returned 0x840000 [0096.946] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.946] GetProcessHeap () returned 0x840000 [0096.946] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.947] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0096.947] GetProcessHeap () returned 0x840000 [0096.947] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0096.947] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0096.947] GetProcessHeap () returned 0x840000 [0096.947] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0096.947] GetProcessHeap () returned 0x840000 [0096.947] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0096.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76cd8ae0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76cd8ae0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0096.947] GetProcessHeap () returned 0x840000 [0096.947] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0096.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0096.947] GetProcessHeap () returned 0x840000 [0096.947] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0096.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0096.997] GetProcessHeap () returned 0x840000 [0096.997] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0096.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.001] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.001] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0x76eb12e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76ed7440, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0097.001] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3665a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0097.001] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0097.002] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0097.002] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.002] GetProcessHeap () returned 0x840000 [0097.002] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.002] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0097.002] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora-sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0097.002] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x58fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0097.002] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0097.002] GetProcessHeap () returned 0x840000 [0097.002] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.007] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.007] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc25a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0097.008] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.008] GetProcessHeap () returned 0x840000 [0097.008] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x34fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x263a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x26fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x205a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x32ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installer.dll", cAlternateFileName="INSTAL~1.DLL")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-32.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-iio.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2aba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x409a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0097.009] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0097.010] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0097.010] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-32.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0097.050] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JdbcOdbc.dll", cAlternateFileName="")) returned 1 [0097.050] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x283a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0097.052] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0097.053] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1afa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0097.063] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb579a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0097.095] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0097.095] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x313a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0097.095] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0097.095] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0097.095] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x239a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x16da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpicom.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x261a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpiexp.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x195a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpinscp.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpioji.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x229a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpishare.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs.exe", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0097.096] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6dba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxml2.dll", cAlternateFileName="")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x269a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxslt.dll", cAlternateFileName="")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x127a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x367a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjpi170_45.dll", cAlternateFileName="NPJPI1~1.DLL")) returned 1 [0097.097] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x35da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npoji610.dll", cAlternateFileName="")) returned 1 [0097.118] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0097.118] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0097.118] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0097.118] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0097.119] GetProcessHeap () returned 0x840000 [0097.119] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.158] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.158] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0097.158] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x27fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x27fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0097.159] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.159] GetProcessHeap () returned 0x840000 [0097.159] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism-d3d.dll", cAlternateFileName="PRISM-~1.DLL")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x70fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2f1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0097.159] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x23ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x177a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-32.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x28fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0097.160] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0097.160] GetProcessHeap () returned 0x840000 [0097.160] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0097.160] FindNextFileW (in: hFindFile=0x937ad8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0097.160] GetProcessHeap () returned 0x840000 [0097.160] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0097.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0097.227] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.229] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0097.229] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="alt-rt.jar", cAlternateFileName="")) returned 1 [0097.229] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0097.229] GetProcessHeap () returned 0x840000 [0097.229] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.229] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.229] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0097.229] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.229] GetProcessHeap () returned 0x840000 [0097.230] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.230] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0097.230] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751d4820, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x751d4820, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x75220ae0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x364427, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0097.230] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12543, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0097.230] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0097.230] GetProcessHeap () returned 0x840000 [0097.230] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.232] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.232] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0097.232] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0097.232] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0097.233] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0097.233] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0097.233] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0097.233] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.233] GetProcessHeap () returned 0x840000 [0097.233] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.233] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0097.233] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0097.233] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0097.233] GetProcessHeap () returned 0x840000 [0097.233] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.236] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.236] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x48cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0097.236] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs", cAlternateFileName="")) returned 1 [0097.236] GetProcessHeap () returned 0x840000 [0097.236] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs.conf", cAlternateFileName="JQS~1.CON")) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqsmessages.properties", cAlternateFileName="JQSMES~1.PRO")) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqsmessages.properties", cAlternateFileName="JQSMES~1.PRO")) returned 0 [0097.298] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.298] GetProcessHeap () returned 0x840000 [0097.298] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0097.298] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1657, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_sv.properties", cAlternateFileName="ME0541~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_CN.properties", cAlternateFileName="ME40CD~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_HK.properties", cAlternateFileName="MEB8B5~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_TW.properties", cAlternateFileName="MECC18~1.PRO")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3687, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif", cAlternateFileName="")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3687, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif", cAlternateFileName="")) returned 0 [0097.299] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.299] GetProcessHeap () returned 0x840000 [0097.299] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75246c40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x75246c40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x75305320, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x449777, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0097.299] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ext", cAlternateFileName="")) returned 1 [0097.299] GetProcessHeap () returned 0x840000 [0097.299] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.354] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.354] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x148f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-32.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0097.355] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x753c3a00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x753c3a00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753e9b60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf790d, dwReserved0=0x0, dwReserved1=0x0, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3e45, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3057d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0097.391] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0097.392] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0097.392] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 0 [0097.392] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.393] GetProcessHeap () returned 0x840000 [0097.393] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.393] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0097.394] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe56, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0097.394] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x28ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0097.394] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fonts", cAlternateFileName="")) returned 1 [0097.394] GetProcessHeap () returned 0x840000 [0097.394] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightDemiItalic.ttf", cAlternateFileName="LUCIDA~2.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightItalic.ttf", cAlternateFileName="LUCIDA~3.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5434c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaBrightRegular.ttf", cAlternateFileName="LUCIDA~4.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d9c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansDemiBold.ttf", cAlternateFileName="LU38C7~1.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaSansRegular.ttf", cAlternateFileName="LU761B~1.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39254, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterBold.ttf", cAlternateFileName="LUE73B~1.TTF")) returned 1 [0097.423] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 1 [0097.424] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 0 [0097.424] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.424] GetProcessHeap () returned 0x840000 [0097.424] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.424] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0097.424] GetProcessHeap () returned 0x840000 [0097.424] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.427] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.427] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0097.427] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0097.427] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.427] GetProcessHeap () returned 0x840000 [0097.427] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.427] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0097.427] GetProcessHeap () returned 0x840000 [0097.427] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.427] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.428] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0097.428] GetProcessHeap () returned 0x840000 [0097.428] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.434] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.434] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0097.434] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="invalid32x32.gif", cAlternateFileName="INVALI~1.GIF")) returned 1 [0097.434] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyDrop32x32.gif", cAlternateFileName="WIN32_~1.GIF")) returned 1 [0097.434] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_CopyNoDrop32x32.gif", cAlternateFileName="WIN32_~2.GIF")) returned 1 [0097.434] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkDrop32x32.gif", cAlternateFileName="WIN32_~3.GIF")) returned 1 [0097.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_LinkNoDrop32x32.gif", cAlternateFileName="WIN32_~4.GIF")) returned 1 [0097.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveDrop32x32.gif", cAlternateFileName="WI06CF~1.GIF")) returned 1 [0097.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 1 [0097.435] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 0 [0097.435] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.435] GetProcessHeap () returned 0x840000 [0097.436] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.436] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 0 [0097.436] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.436] GetProcessHeap () returned 0x840000 [0097.436] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.436] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0097.436] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532b480, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7532b480, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753515e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd9d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0097.436] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1aa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0097.436] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr", cAlternateFileName="")) returned 1 [0097.436] GetProcessHeap () returned 0x840000 [0097.436] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.476] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x488e, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4863, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4863, dwReserved0=0x0, dwReserved1=0x0, cFileName="profile.jfc", cAlternateFileName="")) returned 0 [0097.476] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.476] GetProcessHeap () returned 0x840000 [0097.476] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8204f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7540fcc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7540fcc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce642c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7539d8a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7539d8a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753c3a00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x809cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0097.476] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0097.477] GetProcessHeap () returned 0x840000 [0097.477] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.535] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.535] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0097.535] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0097.535] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3711, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0097.535] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0097.535] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 0 [0097.535] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.536] GetProcessHeap () returned 0x840000 [0097.536] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x753515e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x753515e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7539d8a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x0, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2562c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x751d4820, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3124c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0097.537] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0097.537] GetProcessHeap () returned 0x840000 [0097.537] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1429a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cacerts", cAlternateFileName="")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.policy", cAlternateFileName="JAVAFX~1.POL")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 0 [0097.549] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.550] GetProcessHeap () returned 0x840000 [0097.550] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.550] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0097.550] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0097.550] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zi", cAlternateFileName="")) returned 1 [0097.550] GetProcessHeap () returned 0x840000 [0097.550] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.596] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Africa", cAlternateFileName="")) returned 1 [0097.596] GetProcessHeap () returned 0x840000 [0097.596] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.610] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.622] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Abidjan", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accra", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Addis_Ababa", cAlternateFileName="ADDIS_~1")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Algiers", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Asmara", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bamako", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bangui", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Banjul", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bissau", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blantyre", cAlternateFileName="")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brazzaville", cAlternateFileName="BRAZZA~1")) returned 1 [0097.623] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bujumbura", cAlternateFileName="BUJUMB~1")) returned 1 [0097.624] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.625] GetProcessHeap () returned 0x840000 [0097.625] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.625] GetProcessHeap () returned 0x840000 [0097.625] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.736] GetProcessHeap () returned 0x840000 [0097.736] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0097.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0097.738] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0097.739] GetProcessHeap () returned 0x840000 [0097.739] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0097.740] GetProcessHeap () returned 0x840000 [0097.740] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0097.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0097.741] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0097.742] GetProcessHeap () returned 0x840000 [0097.742] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0097.742] GetProcessHeap () returned 0x840000 [0097.742] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0097.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0097.742] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0097.742] GetProcessHeap () returned 0x840000 [0097.742] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0097.744] GetProcessHeap () returned 0x840000 [0097.744] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0097.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0097.744] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0097.744] GetProcessHeap () returned 0x840000 [0097.744] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0097.744] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.745] GetProcessHeap () returned 0x840000 [0097.745] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.746] GetProcessHeap () returned 0x840000 [0097.746] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.748] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.748] GetProcessHeap () returned 0x840000 [0097.748] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.748] GetProcessHeap () returned 0x840000 [0097.749] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.752] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.753] GetProcessHeap () returned 0x840000 [0097.753] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.753] GetProcessHeap () returned 0x840000 [0097.753] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.787] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.788] GetProcessHeap () returned 0x840000 [0097.788] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.788] GetProcessHeap () returned 0x840000 [0097.788] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.845] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.846] GetProcessHeap () returned 0x840000 [0097.846] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.846] GetProcessHeap () returned 0x840000 [0097.846] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.940] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.940] GetProcessHeap () returned 0x840000 [0097.940] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.940] GetProcessHeap () returned 0x840000 [0097.940] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.945] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.946] GetProcessHeap () returned 0x840000 [0097.946] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.946] GetProcessHeap () returned 0x840000 [0097.946] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.950] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.951] GetProcessHeap () returned 0x840000 [0097.951] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.951] GetProcessHeap () returned 0x840000 [0097.951] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.953] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.954] GetProcessHeap () returned 0x840000 [0097.954] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.954] GetProcessHeap () returned 0x840000 [0097.954] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.956] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.957] GetProcessHeap () returned 0x840000 [0097.957] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.957] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.957] GetProcessHeap () returned 0x840000 [0097.957] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.957] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0097.957] GetProcessHeap () returned 0x840000 [0097.957] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0097.957] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0097.957] GetProcessHeap () returned 0x840000 [0097.957] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0097.958] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0097.959] GetProcessHeap () returned 0x840000 [0097.959] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0097.959] GetProcessHeap () returned 0x840000 [0097.959] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0097.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76888300, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76888300, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0097.959] GetProcessHeap () returned 0x840000 [0097.959] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0097.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0097.959] GetProcessHeap () returned 0x840000 [0097.959] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0097.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0097.962] GetProcessHeap () returned 0x840000 [0097.962] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.965] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.965] GetProcessHeap () returned 0x840000 [0097.965] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.965] GetProcessHeap () returned 0x840000 [0097.965] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.966] GetProcessHeap () returned 0x840000 [0097.966] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0097.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0097.966] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0097.966] GetProcessHeap () returned 0x840000 [0097.966] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0097.966] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.966] GetProcessHeap () returned 0x840000 [0097.966] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.966] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0097.966] GetProcessHeap () returned 0x840000 [0097.966] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0097.966] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0097.966] GetProcessHeap () returned 0x840000 [0097.966] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0097.967] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0097.967] GetProcessHeap () returned 0x840000 [0097.968] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0097.968] GetProcessHeap () returned 0x840000 [0097.968] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0097.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef0a44f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0097.968] GetProcessHeap () returned 0x840000 [0097.968] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0097.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\Office14\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0097.968] GetProcessHeap () returned 0x840000 [0097.968] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0097.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0097.970] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0097.971] GetProcessHeap () returned 0x840000 [0097.971] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0097.971] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0097.971] GetProcessHeap () returned 0x840000 [0097.971] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0097.971] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0097.971] GetProcessHeap () returned 0x840000 [0097.971] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0097.971] GetProcessHeap () returned 0x840000 [0097.972] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0097.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0097.972] GetProcessHeap () returned 0x840000 [0097.972] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0097.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0097.976] GetProcessHeap () returned 0x840000 [0097.976] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0097.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0097.976] GetProcessHeap () returned 0x840000 [0097.976] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0097.976] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0097.977] GetProcessHeap () returned 0x840000 [0097.977] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0097.977] GetProcessHeap () returned 0x840000 [0097.977] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0097.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.049] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.050] GetProcessHeap () returned 0x840000 [0098.050] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.050] GetProcessHeap () returned 0x840000 [0098.050] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.061] GetProcessHeap () returned 0x840000 [0098.061] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.062] GetProcessHeap () returned 0x840000 [0098.062] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.063] GetProcessHeap () returned 0x840000 [0098.063] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0098.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0098.071] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0098.071] GetProcessHeap () returned 0x840000 [0098.071] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0098.071] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.071] GetProcessHeap () returned 0x840000 [0098.071] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.071] GetProcessHeap () returned 0x840000 [0098.071] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.077] GetProcessHeap () returned 0x840000 [0098.077] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0098.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0098.085] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0098.086] GetProcessHeap () returned 0x840000 [0098.086] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0098.086] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.086] GetProcessHeap () returned 0x840000 [0098.086] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.086] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.087] GetProcessHeap () returned 0x840000 [0098.087] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.088] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.088] GetProcessHeap () returned 0x840000 [0098.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.088] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.088] GetProcessHeap () returned 0x840000 [0098.088] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0098.089] GetProcessHeap () returned 0x840000 [0098.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0098.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.089] GetProcessHeap () returned 0x840000 [0098.089] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.089] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.089] GetProcessHeap () returned 0x840000 [0098.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.089] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.089] GetProcessHeap () returned 0x840000 [0098.089] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0098.089] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0098.089] GetProcessHeap () returned 0x840000 [0098.090] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.091] GetProcessHeap () returned 0x840000 [0098.091] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0098.091] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0098.091] GetProcessHeap () returned 0x840000 [0098.091] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.091] GetProcessHeap () returned 0x840000 [0098.091] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937ad8 [0098.096] GetProcessHeap () returned 0x840000 [0098.096] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x925968 [0098.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.097] GetProcessHeap () returned 0x840000 [0098.097] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.219] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.220] GetProcessHeap () returned 0x840000 [0098.220] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.220] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.220] GetProcessHeap () returned 0x840000 [0098.220] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x925968 | out: hHeap=0x840000) returned 1 [0098.220] FindClose (in: hFindFile=0x937ad8 | out: hFindFile=0x937ad8) returned 1 [0098.220] GetProcessHeap () returned 0x840000 [0098.220] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.221] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.234] GetProcessHeap () returned 0x840000 [0098.234] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.234] GetProcessHeap () returned 0x840000 [0098.234] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.234] GetProcessHeap () returned 0x840000 [0098.234] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.297] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.298] GetProcessHeap () returned 0x840000 [0098.298] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.298] GetProcessHeap () returned 0x840000 [0098.298] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.342] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.342] GetProcessHeap () returned 0x840000 [0098.342] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.342] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.342] GetProcessHeap () returned 0x840000 [0098.342] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.342] GetProcessHeap () returned 0x840000 [0098.342] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf1a38c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.353] GetProcessHeap () returned 0x840000 [0098.353] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.437] GetProcessHeap () returned 0x840000 [0098.437] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.474] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.474] GetProcessHeap () returned 0x840000 [0098.474] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.474] GetProcessHeap () returned 0x840000 [0098.474] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.492] GetProcessHeap () returned 0x840000 [0098.492] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.502] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.502] GetProcessHeap () returned 0x840000 [0098.502] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.502] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.502] GetProcessHeap () returned 0x840000 [0098.502] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.502] GetProcessHeap () returned 0x840000 [0098.502] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.505] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.506] GetProcessHeap () returned 0x840000 [0098.506] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.506] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.506] GetProcessHeap () returned 0x840000 [0098.506] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.506] GetProcessHeap () returned 0x840000 [0098.506] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.509] GetProcessHeap () returned 0x840000 [0098.509] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.512] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.512] GetProcessHeap () returned 0x840000 [0098.512] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.512] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.512] GetProcessHeap () returned 0x840000 [0098.512] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.512] GetProcessHeap () returned 0x840000 [0098.513] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.516] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.516] GetProcessHeap () returned 0x840000 [0098.516] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.516] GetProcessHeap () returned 0x840000 [0098.516] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.562] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.562] GetProcessHeap () returned 0x840000 [0098.562] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.562] GetProcessHeap () returned 0x840000 [0098.562] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.562] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.562] GetProcessHeap () returned 0x840000 [0098.562] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.563] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.563] GetProcessHeap () returned 0x840000 [0098.563] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.564] GetProcessHeap () returned 0x840000 [0098.564] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.580] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.581] GetProcessHeap () returned 0x840000 [0098.581] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.581] GetProcessHeap () returned 0x840000 [0098.581] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.581] GetProcessHeap () returned 0x840000 [0098.581] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.582] GetProcessHeap () returned 0x840000 [0098.582] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.582] GetProcessHeap () returned 0x840000 [0098.582] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.583] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.583] GetProcessHeap () returned 0x840000 [0098.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.583] GetProcessHeap () returned 0x840000 [0098.583] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.583] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.583] GetProcessHeap () returned 0x840000 [0098.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.583] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.583] GetProcessHeap () returned 0x840000 [0098.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.583] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.583] GetProcessHeap () returned 0x840000 [0098.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.583] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.583] GetProcessHeap () returned 0x840000 [0098.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.584] GetProcessHeap () returned 0x840000 [0098.584] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.585] GetProcessHeap () returned 0x840000 [0098.585] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.585] GetProcessHeap () returned 0x840000 [0098.586] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.608] GetProcessHeap () returned 0x840000 [0098.608] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.610] GetProcessHeap () returned 0x840000 [0098.610] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.611] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.611] GetProcessHeap () returned 0x840000 [0098.611] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.611] GetProcessHeap () returned 0x840000 [0098.611] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.611] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.611] GetProcessHeap () returned 0x840000 [0098.611] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.611] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.612] GetProcessHeap () returned 0x840000 [0098.612] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.613] GetProcessHeap () returned 0x840000 [0098.613] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.615] GetProcessHeap () returned 0x840000 [0098.615] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.616] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.616] GetProcessHeap () returned 0x840000 [0098.616] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.616] GetProcessHeap () returned 0x840000 [0098.616] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.616] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.616] GetProcessHeap () returned 0x840000 [0098.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.617] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.617] GetProcessHeap () returned 0x840000 [0098.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.618] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.618] GetProcessHeap () returned 0x840000 [0098.618] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.618] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.618] GetProcessHeap () returned 0x840000 [0098.618] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.618] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.618] GetProcessHeap () returned 0x840000 [0098.618] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.619] GetProcessHeap () returned 0x840000 [0098.619] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.620] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.620] GetProcessHeap () returned 0x840000 [0098.620] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.620] GetProcessHeap () returned 0x840000 [0098.620] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.620] GetProcessHeap () returned 0x840000 [0098.620] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.621] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.621] GetProcessHeap () returned 0x840000 [0098.621] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.621] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.621] GetProcessHeap () returned 0x840000 [0098.621] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.621] GetProcessHeap () returned 0x840000 [0098.621] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.633] GetProcessHeap () returned 0x840000 [0098.633] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.634] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.634] GetProcessHeap () returned 0x840000 [0098.634] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.634] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.634] GetProcessHeap () returned 0x840000 [0098.634] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.634] GetProcessHeap () returned 0x840000 [0098.634] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76888300, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76888300, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.634] GetProcessHeap () returned 0x840000 [0098.634] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.634] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.634] GetProcessHeap () returned 0x840000 [0098.634] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.634] GetProcessHeap () returned 0x840000 [0098.634] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Icons\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.635] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.635] GetProcessHeap () returned 0x840000 [0098.635] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.635] GetProcessHeap () returned 0x840000 [0098.635] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.655] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.656] GetProcessHeap () returned 0x840000 [0098.656] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.656] GetProcessHeap () returned 0x840000 [0098.656] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.656] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.656] GetProcessHeap () returned 0x840000 [0098.656] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.657] GetProcessHeap () returned 0x840000 [0098.657] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Skins\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.657] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.657] GetProcessHeap () returned 0x840000 [0098.657] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.657] GetProcessHeap () returned 0x840000 [0098.657] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.657] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.657] GetProcessHeap () returned 0x840000 [0098.657] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.657] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.658] GetProcessHeap () returned 0x840000 [0098.658] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.658] GetProcessHeap () returned 0x840000 [0098.658] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x76888300, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x76888300, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.658] GetProcessHeap () returned 0x840000 [0098.658] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\Accessories\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.661] GetProcessHeap () returned 0x840000 [0098.661] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.662] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.662] GetProcessHeap () returned 0x840000 [0098.662] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.662] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.662] GetProcessHeap () returned 0x840000 [0098.662] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.662] GetProcessHeap () returned 0x840000 [0098.662] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\TableTextService\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.667] GetProcessHeap () returned 0x840000 [0098.667] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.668] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.668] GetProcessHeap () returned 0x840000 [0098.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.668] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.668] GetProcessHeap () returned 0x840000 [0098.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.668] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.668] GetProcessHeap () returned 0x840000 [0098.668] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.669] GetProcessHeap () returned 0x840000 [0098.669] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.672] GetProcessHeap () returned 0x840000 [0098.672] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.673] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.673] GetProcessHeap () returned 0x840000 [0098.673] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.673] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.673] GetProcessHeap () returned 0x840000 [0098.673] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.673] GetProcessHeap () returned 0x840000 [0098.673] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x768ae460, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x768ae460, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.673] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0098.674] GetProcessHeap () returned 0x840000 [0098.674] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0098.674] GetProcessHeap () returned 0x840000 [0098.674] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0098.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0098.676] GetProcessHeap () returned 0x840000 [0098.676] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.739] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0098.739] GetProcessHeap () returned 0x840000 [0098.739] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0098.739] GetProcessHeap () returned 0x840000 [0098.739] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0098.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0098.745] GetProcessHeap () returned 0x840000 [0098.745] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.746] GetProcessHeap () returned 0x840000 [0098.746] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.746] GetProcessHeap () returned 0x840000 [0098.746] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.757] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.761] GetProcessHeap () returned 0x840000 [0098.761] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.761] GetProcessHeap () returned 0x840000 [0098.761] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.761] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.761] GetProcessHeap () returned 0x840000 [0098.761] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.761] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.761] GetProcessHeap () returned 0x840000 [0098.761] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.763] GetProcessHeap () returned 0x840000 [0098.763] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.764] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.765] GetProcessHeap () returned 0x840000 [0098.765] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.765] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0098.765] GetProcessHeap () returned 0x840000 [0098.765] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0098.765] GetProcessHeap () returned 0x840000 [0098.765] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0098.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0098.765] GetProcessHeap () returned 0x840000 [0098.765] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0098.878] GetProcessHeap () returned 0x840000 [0098.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.879] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.879] GetProcessHeap () returned 0x840000 [0098.880] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.880] GetProcessHeap () returned 0x840000 [0098.880] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0098.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0098.880] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0098.880] GetProcessHeap () returned 0x840000 [0098.880] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0098.880] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0098.880] GetProcessHeap () returned 0x840000 [0098.880] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0098.881] GetProcessHeap () returned 0x840000 [0098.881] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0098.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.031] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.032] GetProcessHeap () returned 0x840000 [0099.032] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.032] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.032] GetProcessHeap () returned 0x840000 [0099.032] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.032] GetProcessHeap () returned 0x840000 [0099.032] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.076] GetProcessHeap () returned 0x840000 [0099.076] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.076] GetProcessHeap () returned 0x840000 [0099.077] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.078] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.078] GetProcessHeap () returned 0x840000 [0099.078] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.078] GetProcessHeap () returned 0x840000 [0099.078] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.078] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.078] GetProcessHeap () returned 0x840000 [0099.078] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.078] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.078] GetProcessHeap () returned 0x840000 [0099.078] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.080] GetProcessHeap () returned 0x840000 [0099.080] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.123] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.124] GetProcessHeap () returned 0x840000 [0099.124] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.124] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.124] GetProcessHeap () returned 0x840000 [0099.124] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.124] GetProcessHeap () returned 0x840000 [0099.124] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.124] GetProcessHeap () returned 0x840000 [0099.124] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.124] GetProcessHeap () returned 0x840000 [0099.124] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.125] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.126] GetProcessHeap () returned 0x840000 [0099.126] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.126] GetProcessHeap () returned 0x840000 [0099.126] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.130] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.130] GetProcessHeap () returned 0x840000 [0099.130] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.130] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.130] GetProcessHeap () returned 0x840000 [0099.130] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.131] GetProcessHeap () returned 0x840000 [0099.131] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb8048a8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb8048a8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb67725c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb661993, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb661993, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb67725c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_down.png", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb69d3bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_over.png", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb69d3bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_up.png", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6156d5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb6156d5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6c351c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-docked.png", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6c351c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbb6c351c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbb6c351c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xaa66, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-2.png", cAlternateFileName="")) returned 1 [0099.218] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5c9417, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb5c9417, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6c351c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd31a, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-3.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5ef576, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb5ef576, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6e967c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xf240, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-4.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb76c32c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb76c32c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb70f7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb93, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-left.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb79248b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb79248b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb70f7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb45, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-middle.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7b85ea, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb7b85ea, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb70f7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-right.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d3db0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb6d3db0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb73593c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_down.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb687af2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb687af2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb73593c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_over.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb687af2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb687af2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_up.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7461cd, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb7461cd, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_down.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6f9f0f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb6f9f0f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_over.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb72006e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb72006e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_up.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb8048a8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb8048a8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7f401c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7b85ea, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb7b85ea, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7f401c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x0, dwReserved1=0x0, cFileName="row_over.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb81a17c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 1 [0099.219] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb81a17c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 0 [0099.219] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.220] GetProcessHeap () returned 0x840000 [0099.220] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.220] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcba7da4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcba7da4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb8d885c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0099.220] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcba7da4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcba7da4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb8d885c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0099.220] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.220] GetProcessHeap () returned 0x840000 [0099.220] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.220] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0099.221] GetProcessHeap () returned 0x840000 [0099.221] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.221] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.221] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa54a84, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaa54a84, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc07b211c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0099.221] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.221] GetProcessHeap () returned 0x840000 [0099.221] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.221] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.221] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0099.221] GetProcessHeap () returned 0x840000 [0099.221] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.249] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.249] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0099.249] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0099.249] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0099.249] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.249] GetProcessHeap () returned 0x840000 [0099.254] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.255] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0099.267] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0099.271] GetProcessHeap () returned 0x840000 [0099.271] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.272] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.272] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0099.272] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0099.272] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0099.272] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.272] GetProcessHeap () returned 0x840000 [0099.272] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.272] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.html", cAlternateFileName="")) returned 1 [0099.272] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0099.272] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0099.272] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.272] GetProcessHeap () returned 0x840000 [0099.272] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.274] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc082453c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc082453c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc082453c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0099.274] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0099.274] GetProcessHeap () returned 0x840000 [0099.274] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.374] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.452] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc082453c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc082453c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc082453c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0099.452] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba036d48, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba036d48, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc082453c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5323, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0099.452] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba11b582, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba11b582, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc084a69c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1416e1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1416e1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc084a69c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6936, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba05cea7, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba05cea7, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08707fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7210, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba083006, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba083006, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08707fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba083006, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba083006, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08707fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0a9165, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0a9165, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc089695c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x61bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0cf2c4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0cf2c4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08bcabc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0cf2c4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0cf2c4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08e2c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x493b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0f5423, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0f5423, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08e2c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x52a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba11b582, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba11b582, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0908d7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x531b, dwReserved0=0x0, dwReserved1=0x0, cFileName="9.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1b3afe, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1b3afe, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0908d7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x46a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1416e1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1416e1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="daisies.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba167840, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba167840, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="glow.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba24c07a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba24c07a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_down.png", cAlternateFileName="")) returned 1 [0099.453] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba225f1b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba225f1b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_over.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2721d9, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2721d9, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc095503c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_up.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2be497, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2be497, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc095503c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2e45f6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2e45f6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2e45f6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2e45f6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba30a755, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba30a755, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba30a755, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba30a755, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba30a755, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba30a755, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3308b4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3308b4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba356a13, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba356a13, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba356a13, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba356a13, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37cb72, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba37cb72, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37cb72, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba37cb72, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09c745c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3a2cd1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3a2cd1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09c745c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3a2cd1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3a2cd1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09c745c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0099.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3c8e30, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3c8e30, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09ed5bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3c8e30, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3c8e30, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09ed5bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3eef8f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3eef8f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0a1371c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4150ee, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4150ee, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0a3987c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4150ee, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4150ee, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0a3987c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba43b24d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba43b24d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0aabc9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4613ac, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4613ac, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0ad1dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba48750b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba48750b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0ad1dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ad66a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4ad66a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc095503c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="setting_back.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2be497, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2be497, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b1e0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_down.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba298338, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba298338, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b1e0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd33, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_over.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2be497, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2be497, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b1e0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_up.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba167840, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba167840, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b6a37c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile16.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba18d99f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba18d99f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b6a37c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_bezel.png", cAlternateFileName="")) returned 1 [0099.455] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba18d99f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba18d99f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0bdc79c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb43, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_drop_shadow.png", cAlternateFileName="")) returned 1 [0099.456] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba225f1b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba225f1b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_down.png", cAlternateFileName="")) returned 1 [0099.456] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1d9c5d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1d9c5d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd37, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_over.png", cAlternateFileName="")) returned 1 [0099.456] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1d9c5d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1d9c5d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 1 [0099.456] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1d9c5d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1d9c5d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 0 [0099.456] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.457] GetProcessHeap () returned 0x840000 [0099.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa7abe3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaa7abe3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c74d1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0099.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa7abe3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaa7abe3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c74d1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0099.457] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.457] GetProcessHeap () returned 0x840000 [0099.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.457] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0099.457] GetProcessHeap () returned 0x840000 [0099.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb96990, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbb96990, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc45e1fdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0099.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.457] GetProcessHeap () returned 0x840000 [0099.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.459] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.459] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0099.459] GetProcessHeap () returned 0x840000 [0099.460] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.461] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.css", cAlternateFileName="")) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0099.461] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.461] GetProcessHeap () returned 0x840000 [0099.461] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0099.461] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0099.461] GetProcessHeap () returned 0x840000 [0099.461] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.462] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0099.462] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.462] GetProcessHeap () returned 0x840000 [0099.462] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x271c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.html", cAlternateFileName="")) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0099.462] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0099.462] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.462] GetProcessHeap () returned 0x840000 [0099.462] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.463] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc467a55c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc467a55c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc467a55c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0099.463] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0099.464] GetProcessHeap () returned 0x840000 [0099.464] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc467a55c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc467a55c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc48435dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b8003, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5b8003, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f4167c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonDown_Off.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5de162, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5de162, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f677dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonDown_On.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b8003, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5b8003, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f8d93c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonUp_Off.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b8003, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5b8003, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f8d93c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonUp_On.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba6042c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba6042c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4fb3a9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyoutBack.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4f9928, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4f9928, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4fb3a9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_docked.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba51fa87, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba51fa87, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc5d89a7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_floating.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba545be6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba545be6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_flyout.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56bd45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba56bd45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="navBack.png", cAlternateFileName="")) returned 1 [0099.466] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba6042c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba6042c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssBackBlue_docked.png", cAlternateFileName="")) returned 1 [0099.467] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba62a420, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba62a420, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x22ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssBackBlue_Undocked.png", cAlternateFileName="")) returned 1 [0099.467] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69bcb3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssLogo.gif", cAlternateFileName="")) returned 1 [0099.467] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56bd45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba56bd45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_docked.png", cAlternateFileName="")) returned 1 [0099.467] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_floating.png", cAlternateFileName="")) returned 1 [0099.467] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 1 [0099.467] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 0 [0099.467] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.468] GetProcessHeap () returned 0x840000 [0099.468] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.468] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb4a6d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbb4a6d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc6d0297c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0099.468] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb4a6d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbb4a6d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc6d0297c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0099.468] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.468] GetProcessHeap () returned 0x840000 [0099.468] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.468] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0099.468] GetProcessHeap () returned 0x840000 [0099.468] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.469] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.469] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbafe414, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbafe414, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb0b3b1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0099.470] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.470] GetProcessHeap () returned 0x840000 [0099.470] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.470] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.470] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0099.470] GetProcessHeap () returned 0x840000 [0099.470] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.471] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.471] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0099.471] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 1 [0099.471] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 0 [0099.471] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.471] GetProcessHeap () returned 0x840000 [0099.471] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.471] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0099.472] GetProcessHeap () returned 0x840000 [0099.472] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.472] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 0 [0099.472] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.472] GetProcessHeap () returned 0x840000 [0099.472] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1910, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 1 [0099.472] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 0 [0099.472] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.472] GetProcessHeap () returned 0x840000 [0099.472] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.474] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb0ffddc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb0ffddc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb0ffddc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2732, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0099.474] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0099.474] GetProcessHeap () returned 0x840000 [0099.474] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.513] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.513] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7f0e8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbae7f0e8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb0ffddc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0099.513] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="in_sidebar", cAlternateFileName="IN_SID~1")) returned 1 [0099.513] GetProcessHeap () returned 0x840000 [0099.513] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.514] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.514] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb125f3c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb125f3c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb125f3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0099.514] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad9a8ae, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbad9a8ae, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0099.514] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad9a8ae, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbad9a8ae, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 0 [0099.514] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.515] GetProcessHeap () returned 0x840000 [0099.515] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb14c09c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb14c09c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_down.png", cAlternateFileName="")) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad9a8ae, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbad9a8ae, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_hov.png", cAlternateFileName="")) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbadc0a0d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbadc0a0d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1721fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_rest.png", cAlternateFileName="")) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="on_desktop", cAlternateFileName="ON_DES~1")) returned 1 [0099.515] GetProcessHeap () returned 0x840000 [0099.515] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.515] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19835c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb19835c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb19835c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19835c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb19835c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb19835c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 0 [0099.515] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.515] GetProcessHeap () returned 0x840000 [0099.515] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7f0e8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbae7f0e8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb19835c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbca, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_down.png", cAlternateFileName="")) returned 1 [0099.515] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaea5247, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaea5247, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1be4bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_hov.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaecb3a6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaecb3a6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1e461c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb11, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_rest.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaef1505, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaef1505, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1e461c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_down.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf17664, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf17664, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb20a77c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_hov.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf17664, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf17664, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb256a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb46, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_rest.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf3d7c3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf3d7c3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb256a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_down.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf3d7c3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf3d7c3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb27cb9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc05, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_hov.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf89a81, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf89a81, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb27cb9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_rest.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf89a81, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf89a81, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb27cb9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_down.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafafbe0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbafafbe0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb31511c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_hov.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafafbe0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbafafbe0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb31511c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_rest.png", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbade6b6c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbade6b6c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb33b27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbade6b6c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbade6b6c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb33b27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 0 [0099.516] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.516] GetProcessHeap () returned 0x840000 [0099.516] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbad82b5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbad82b5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb3d37fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbad82b5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbad82b5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb3d37fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0099.518] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.518] GetProcessHeap () returned 0x840000 [0099.518] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0099.518] GetProcessHeap () returned 0x840000 [0099.518] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.518] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf39e8c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcf39e8c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd379e7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0099.518] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.519] GetProcessHeap () returned 0x840000 [0099.519] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.520] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.520] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0099.520] GetProcessHeap () returned 0x840000 [0099.520] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.521] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.521] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedSettings.css", cAlternateFileName="")) returned 1 [0099.521] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2786, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0099.521] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x603c, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.css", cAlternateFileName="")) returned 1 [0099.521] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x603c, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.css", cAlternateFileName="")) returned 0 [0099.521] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.522] GetProcessHeap () returned 0x840000 [0099.522] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0099.522] GetProcessHeap () returned 0x840000 [0099.522] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highDpiImageSwap.js", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xab00, dwReserved0=0x0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x388c, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe268, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x210ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.js", cAlternateFileName="")) returned 1 [0099.522] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x210ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.js", cAlternateFileName="")) returned 0 [0099.522] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.522] GetProcessHeap () returned 0x840000 [0099.522] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.523] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x20be, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0099.523] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.html", cAlternateFileName="")) returned 1 [0099.523] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.html", cAlternateFileName="")) returned 0 [0099.523] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.523] GetProcessHeap () returned 0x840000 [0099.523] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.524] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd6739fc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbd6739fc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbd6739fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0099.524] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0099.524] GetProcessHeap () returned 0x840000 [0099.524] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.592] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd699b5c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbd699b5c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbd699b5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0099.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc00d2b2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc00d2b2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd699b5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0099.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc00d2b2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc00d2b2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6bfcbc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0099.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc033411, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc033411, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6bfcbc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.png", cAlternateFileName="")) returned 1 [0099.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="120DPI", cAlternateFileName="")) returned 1 [0099.600] GetProcessHeap () returned 0x840000 [0099.600] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe19c11c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbe19c11c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbe19c11c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf02919, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbf02919, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe1c227c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)grayStateIcon.png", cAlternateFileName="")) returned 1 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf28a78, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbf28a78, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe1c227c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)greenStateIcon.png", cAlternateFileName="")) returned 1 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf28a78, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbf28a78, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe1e83dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf4ebd7, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbf4ebd7, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe1e83dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)redStateIcon.png", cAlternateFileName="")) returned 1 [0099.610] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf4ebd7, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbf4ebd7, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe1e83dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)redStateIcon.png", cAlternateFileName="")) returned 0 [0099.610] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.611] GetProcessHeap () returned 0x840000 [0099.611] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.611] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc033411, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc033411, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6bfcbc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="13.png", cAlternateFileName="")) returned 1 [0099.611] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc07f6cf, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc07f6cf, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6e5e1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.png", cAlternateFileName="")) returned 1 [0099.611] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="144DPI", cAlternateFileName="")) returned 1 [0099.611] GetProcessHeap () returned 0x840000 [0099.612] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.615] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.615] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe38b2fc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbe38b2fc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbe38b2fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc26e8a2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc26e8a2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe3b145c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)grayStateIcon.png", cAlternateFileName="")) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc294a01, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc294a01, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe3d75bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)greenStateIcon.png", cAlternateFileName="")) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2bab60, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc2bab60, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe3fd71c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306e1e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc306e1e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe3fd71c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)redStateIcon.png", cAlternateFileName="")) returned 1 [0099.616] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc306e1e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc306e1e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbe3fd71c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)redStateIcon.png", cAlternateFileName="")) returned 0 [0099.616] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.617] GetProcessHeap () returned 0x840000 [0099.617] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0a582e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0a582e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6e5e1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="15.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0a582e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0a582e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6e5e1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0cb98d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0cb98d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0cb98d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0cb98d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="18.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0f1aec, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0f1aec, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="19.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0f1aec, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0f1aec, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1px.gif", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc117c4b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc117c4b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc13ddaa, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc13ddaa, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="20.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc13ddaa, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc13ddaa, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="21.png", cAlternateFileName="")) returned 1 [0099.617] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc13ddaa, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc13ddaa, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd70bf7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="22.png", cAlternateFileName="")) returned 1 [0099.669] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.669] GetProcessHeap () returned 0x840000 [0099.669] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.669] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.669] GetProcessHeap () returned 0x840000 [0099.669] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.669] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.669] GetProcessHeap () returned 0x840000 [0099.669] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.669] GetProcessHeap () returned 0x840000 [0099.669] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.670] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.670] GetProcessHeap () returned 0x840000 [0099.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.670] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0099.670] GetProcessHeap () returned 0x840000 [0099.670] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0099.671] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0099.671] GetProcessHeap () returned 0x840000 [0099.671] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0099.671] GetProcessHeap () returned 0x840000 [0099.671] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0099.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0099.672] GetProcessHeap () returned 0x840000 [0099.672] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0099.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0099.674] GetProcessHeap () returned 0x840000 [0099.674] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.675] GetProcessHeap () returned 0x840000 [0099.675] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.675] GetProcessHeap () returned 0x840000 [0099.675] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.763] GetProcessHeap () returned 0x840000 [0099.763] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.764] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.764] GetProcessHeap () returned 0x840000 [0099.764] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.764] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.764] GetProcessHeap () returned 0x840000 [0099.764] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.766] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.766] GetProcessHeap () returned 0x840000 [0099.766] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.766] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.766] GetProcessHeap () returned 0x840000 [0099.766] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.766] GetProcessHeap () returned 0x840000 [0099.766] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.766] GetProcessHeap () returned 0x840000 [0099.766] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.769] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.769] GetProcessHeap () returned 0x840000 [0099.769] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.769] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.769] GetProcessHeap () returned 0x840000 [0099.769] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.769] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0099.770] GetProcessHeap () returned 0x840000 [0099.770] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0099.771] GetProcessHeap () returned 0x840000 [0099.771] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0099.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0099.771] GetProcessHeap () returned 0x840000 [0099.771] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.772] GetProcessHeap () returned 0x840000 [0099.772] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.772] GetProcessHeap () returned 0x840000 [0099.772] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.773] GetProcessHeap () returned 0x840000 [0099.773] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.778] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.778] GetProcessHeap () returned 0x840000 [0099.778] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.778] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.781] GetProcessHeap () returned 0x840000 [0099.781] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.782] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.782] GetProcessHeap () returned 0x840000 [0099.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.782] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.782] GetProcessHeap () returned 0x840000 [0099.782] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.782] GetProcessHeap () returned 0x840000 [0099.782] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.783] GetProcessHeap () returned 0x840000 [0099.783] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.783] GetProcessHeap () returned 0x840000 [0099.783] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.783] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.783] GetProcessHeap () returned 0x840000 [0099.783] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.783] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.783] GetProcessHeap () returned 0x840000 [0099.783] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.784] GetProcessHeap () returned 0x840000 [0099.784] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.785] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.785] GetProcessHeap () returned 0x840000 [0099.785] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.785] GetProcessHeap () returned 0x840000 [0099.785] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.785] GetProcessHeap () returned 0x840000 [0099.785] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.785] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.785] GetProcessHeap () returned 0x840000 [0099.785] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.786] GetProcessHeap () returned 0x840000 [0099.786] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.787] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.787] GetProcessHeap () returned 0x840000 [0099.787] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.787] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.787] GetProcessHeap () returned 0x840000 [0099.787] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.787] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.787] GetProcessHeap () returned 0x840000 [0099.787] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.787] GetProcessHeap () returned 0x840000 [0099.787] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.787] GetProcessHeap () returned 0x840000 [0099.787] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.788] GetProcessHeap () returned 0x840000 [0099.788] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.790] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.791] GetProcessHeap () returned 0x840000 [0099.791] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.791] GetProcessHeap () returned 0x840000 [0099.791] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.791] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.791] GetProcessHeap () returned 0x840000 [0099.791] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.791] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.791] GetProcessHeap () returned 0x840000 [0099.792] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.792] GetProcessHeap () returned 0x840000 [0099.792] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.792] GetProcessHeap () returned 0x840000 [0099.792] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.794] GetProcessHeap () returned 0x840000 [0099.794] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.795] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.795] GetProcessHeap () returned 0x840000 [0099.795] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.795] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.795] GetProcessHeap () returned 0x840000 [0099.795] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.796] GetProcessHeap () returned 0x840000 [0099.796] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.798] GetProcessHeap () returned 0x840000 [0099.798] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.799] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.799] GetProcessHeap () returned 0x840000 [0099.799] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.799] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.799] GetProcessHeap () returned 0x840000 [0099.799] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.801] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.801] GetProcessHeap () returned 0x840000 [0099.801] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.801] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.801] GetProcessHeap () returned 0x840000 [0099.801] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.801] GetProcessHeap () returned 0x840000 [0099.801] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.802] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.802] GetProcessHeap () returned 0x840000 [0099.802] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.802] GetProcessHeap () returned 0x840000 [0099.802] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.802] GetProcessHeap () returned 0x840000 [0099.802] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.803] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.803] GetProcessHeap () returned 0x840000 [0099.803] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.803] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.803] GetProcessHeap () returned 0x840000 [0099.803] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.803] GetProcessHeap () returned 0x840000 [0099.803] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.803] GetProcessHeap () returned 0x840000 [0099.803] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.803] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.803] GetProcessHeap () returned 0x840000 [0099.803] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.804] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.804] GetProcessHeap () returned 0x840000 [0099.804] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.804] GetProcessHeap () returned 0x840000 [0099.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.804] GetProcessHeap () returned 0x840000 [0099.804] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.805] GetProcessHeap () returned 0x840000 [0099.805] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.805] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.805] GetProcessHeap () returned 0x840000 [0099.805] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.805] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.805] GetProcessHeap () returned 0x840000 [0099.805] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.805] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.805] GetProcessHeap () returned 0x840000 [0099.805] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.805] GetProcessHeap () returned 0x840000 [0099.805] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.806] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.806] GetProcessHeap () returned 0x840000 [0099.806] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.806] GetProcessHeap () returned 0x840000 [0099.806] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.806] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.806] GetProcessHeap () returned 0x840000 [0099.806] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.806] GetProcessHeap () returned 0x840000 [0099.806] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.806] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.806] GetProcessHeap () returned 0x840000 [0099.806] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.806] GetProcessHeap () returned 0x840000 [0099.807] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.807] GetProcessHeap () returned 0x840000 [0099.807] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.807] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.807] GetProcessHeap () returned 0x840000 [0099.807] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.807] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.807] GetProcessHeap () returned 0x840000 [0099.807] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.807] GetProcessHeap () returned 0x840000 [0099.807] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.808] GetProcessHeap () returned 0x840000 [0099.808] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.808] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.808] GetProcessHeap () returned 0x840000 [0099.808] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.808] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.809] GetProcessHeap () returned 0x840000 [0099.809] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.809] GetProcessHeap () returned 0x840000 [0099.809] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.809] GetProcessHeap () returned 0x840000 [0099.809] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.809] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.809] GetProcessHeap () returned 0x840000 [0099.809] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.809] GetProcessHeap () returned 0x840000 [0099.809] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.810] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.810] GetProcessHeap () returned 0x840000 [0099.810] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.810] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.810] GetProcessHeap () returned 0x840000 [0099.810] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.810] GetProcessHeap () returned 0x840000 [0099.810] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.811] GetProcessHeap () returned 0x840000 [0099.811] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.812] GetProcessHeap () returned 0x840000 [0099.812] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.814] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.815] GetProcessHeap () returned 0x840000 [0099.815] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.815] GetProcessHeap () returned 0x840000 [0099.815] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.819] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.819] GetProcessHeap () returned 0x840000 [0099.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.819] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.819] GetProcessHeap () returned 0x840000 [0099.819] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.819] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.820] GetProcessHeap () returned 0x840000 [0099.820] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.820] GetProcessHeap () returned 0x840000 [0099.820] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.820] GetProcessHeap () returned 0x840000 [0099.820] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.820] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.820] GetProcessHeap () returned 0x840000 [0099.820] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.820] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.820] GetProcessHeap () returned 0x840000 [0099.820] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.820] GetProcessHeap () returned 0x840000 [0099.820] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.821] GetProcessHeap () returned 0x840000 [0099.821] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.821] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.821] GetProcessHeap () returned 0x840000 [0099.821] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.821] GetProcessHeap () returned 0x840000 [0099.821] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75fc11e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x75fc11e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.821] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.821] GetProcessHeap () returned 0x840000 [0099.821] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.821] GetProcessHeap () returned 0x840000 [0099.821] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x75f9b080, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x75fc11e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.821] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.822] GetProcessHeap () returned 0x840000 [0099.822] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.822] GetProcessHeap () returned 0x840000 [0099.822] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x760a5a20, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x760a5a20, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.822] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.822] GetProcessHeap () returned 0x840000 [0099.822] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.822] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.822] GetProcessHeap () returned 0x840000 [0099.822] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.822] GetProcessHeap () returned 0x840000 [0099.822] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.823] GetProcessHeap () returned 0x840000 [0099.823] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.823] GetProcessHeap () returned 0x840000 [0099.823] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.824] GetProcessHeap () returned 0x840000 [0099.824] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.826] GetProcessHeap () returned 0x840000 [0099.826] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.827] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.827] GetProcessHeap () returned 0x840000 [0099.827] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.827] GetProcessHeap () returned 0x840000 [0099.827] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.827] GetProcessHeap () returned 0x840000 [0099.828] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0099.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0099.828] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0099.828] GetProcessHeap () returned 0x840000 [0099.828] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0099.828] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.829] GetProcessHeap () returned 0x840000 [0099.829] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.829] GetProcessHeap () returned 0x840000 [0099.829] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.829] GetProcessHeap () returned 0x840000 [0099.829] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0099.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0099.830] GetProcessHeap () returned 0x840000 [0099.830] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0099.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0099.830] GetProcessHeap () returned 0x840000 [0099.830] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32b0068 [0099.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x289dbe0 | out: lpFindFileData=0x289dbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d98 [0099.832] FindClose (in: hFindFile=0x937d98 | out: hFindFile=0x937d98) returned 1 [0099.833] GetProcessHeap () returned 0x840000 [0099.833] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32b0068 | out: hHeap=0x840000) returned 1 [0099.833] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0099.833] GetProcessHeap () returned 0x840000 [0099.833] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0099.833] GetProcessHeap () returned 0x840000 [0099.833] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0099.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0099.834] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0099.834] GetProcessHeap () returned 0x840000 [0099.834] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0099.834] GetProcessHeap () returned 0x840000 [0099.834] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0099.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0099.834] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0099.834] GetProcessHeap () returned 0x840000 [0099.834] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0099.834] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0099.834] GetProcessHeap () returned 0x840000 [0099.834] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0099.834] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.834] GetProcessHeap () returned 0x840000 [0099.834] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.834] SetEvent (hEvent=0x158) returned 1 [0099.835] ResetEvent (hEvent=0x15c) returned 1 [0099.842] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0099.843] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.843] GetProcessHeap () returned 0x840000 [0099.843] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.843] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0099.843] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.843] GetProcessHeap () returned 0x840000 [0099.843] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.844] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0099.844] GetProcessHeap () returned 0x840000 [0099.844] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.845] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.845] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.845] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.845] GetProcessHeap () returned 0x840000 [0099.845] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.845] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0099.845] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.845] GetProcessHeap () returned 0x840000 [0099.845] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.845] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0099.845] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.848] GetProcessHeap () returned 0x840000 [0099.848] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.848] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0099.848] GetProcessHeap () returned 0x840000 [0099.848] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.849] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.849] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0099.849] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0099.849] GetProcessHeap () returned 0x840000 [0099.849] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.850] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.850] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0099.850] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0099.850] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0099.850] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0099.851] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0099.852] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0099.853] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0099.853] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0099.853] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0099.853] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.853] GetProcessHeap () returned 0x840000 [0099.853] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.853] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0099.854] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0099.854] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0099.854] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.854] GetProcessHeap () returned 0x840000 [0099.854] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.854] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0099.854] GetProcessHeap () returned 0x840000 [0099.854] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.854] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.854] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.854] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.854] GetProcessHeap () returned 0x840000 [0099.854] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.854] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0099.854] GetProcessHeap () returned 0x840000 [0099.854] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.855] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.855] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.855] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.855] GetProcessHeap () returned 0x840000 [0099.855] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.855] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0099.855] GetProcessHeap () returned 0x840000 [0099.856] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.856] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.856] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0099.856] GetProcessHeap () returned 0x840000 [0099.856] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.856] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.856] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.856] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.856] GetProcessHeap () returned 0x840000 [0099.856] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.856] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0099.857] GetProcessHeap () returned 0x840000 [0099.857] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.857] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0099.857] GetProcessHeap () returned 0x840000 [0099.857] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.857] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1 [0099.857] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0 [0099.857] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.858] GetProcessHeap () returned 0x840000 [0099.858] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.858] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0099.858] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.858] GetProcessHeap () returned 0x840000 [0099.858] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.858] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0099.858] GetProcessHeap () returned 0x840000 [0099.858] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.859] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.859] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0099.859] GetProcessHeap () returned 0x840000 [0099.859] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.859] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.859] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.859] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.859] GetProcessHeap () returned 0x840000 [0099.859] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.859] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0099.859] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.859] GetProcessHeap () returned 0x840000 [0099.859] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.859] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0099.859] GetProcessHeap () returned 0x840000 [0099.859] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.860] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.860] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.860] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.860] GetProcessHeap () returned 0x840000 [0099.860] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.860] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0099.860] GetProcessHeap () returned 0x840000 [0099.860] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1 [0099.862] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 0 [0099.862] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.864] GetProcessHeap () returned 0x840000 [0099.864] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.864] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0099.864] GetProcessHeap () returned 0x840000 [0099.864] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.868] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.868] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0099.869] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0099.869] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.870] GetProcessHeap () returned 0x840000 [0099.870] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.870] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0099.870] GetProcessHeap () returned 0x840000 [0099.870] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.870] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.871] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0099.871] GetProcessHeap () returned 0x840000 [0099.871] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.871] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.871] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.871] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.871] GetProcessHeap () returned 0x840000 [0099.871] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.871] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0099.871] GetProcessHeap () returned 0x840000 [0099.871] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.872] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.872] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.872] GetProcessHeap () returned 0x840000 [0099.872] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0099.872] GetProcessHeap () returned 0x840000 [0099.872] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.872] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0099.872] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.872] GetProcessHeap () returned 0x840000 [0099.872] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0099.872] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.872] GetProcessHeap () returned 0x840000 [0099.872] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.872] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0099.872] GetProcessHeap () returned 0x840000 [0099.873] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.873] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.873] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0099.873] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.873] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0099.873] GetProcessHeap () returned 0x840000 [0099.873] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.873] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.873] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0099.873] GetProcessHeap () returned 0x840000 [0099.873] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.874] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.874] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0099.874] GetProcessHeap () returned 0x840000 [0099.874] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.875] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0099.875] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.875] GetProcessHeap () returned 0x840000 [0099.875] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0099.875] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0099.876] GetProcessHeap () returned 0x840000 [0099.876] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0099.876] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0099.877] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0099.878] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.878] GetProcessHeap () returned 0x840000 [0099.878] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0099.878] GetProcessHeap () returned 0x840000 [0099.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0099.878] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0099.878] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.879] GetProcessHeap () returned 0x840000 [0099.879] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0099.879] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.879] GetProcessHeap () returned 0x840000 [0099.879] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0099.879] GetProcessHeap () returned 0x840000 [0099.879] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0099.879] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0099.880] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.880] GetProcessHeap () returned 0x840000 [0099.880] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.880] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0099.881] GetProcessHeap () returned 0x840000 [0099.881] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.881] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.881] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.881] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0099.881] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0099.881] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.881] GetProcessHeap () returned 0x840000 [0099.881] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.881] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0099.881] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0099.881] GetProcessHeap () returned 0x840000 [0099.881] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0099.882] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0099.882] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.883] GetProcessHeap () returned 0x840000 [0099.883] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.883] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0099.883] GetProcessHeap () returned 0x840000 [0099.883] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.883] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.883] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0099.884] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.884] GetProcessHeap () returned 0x840000 [0099.884] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0099.884] GetProcessHeap () returned 0x840000 [0099.884] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0099.884] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0099.885] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0099.885] GetProcessHeap () returned 0x840000 [0099.885] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.885] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.885] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1 [0099.885] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0099.886] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0099.886] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0099.886] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0099.886] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1 [0099.886] FindNextFileW (in: hFindFile=0x937c98, lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0 [0099.886] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.887] GetProcessHeap () returned 0x840000 [0099.887] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0099.887] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.887] GetProcessHeap () returned 0x840000 [0099.887] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0099.887] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0099.888] GetProcessHeap () returned 0x840000 [0099.888] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.888] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.888] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0099.888] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0099.888] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.889] GetProcessHeap () returned 0x840000 [0099.889] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.889] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0099.889] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9fea71e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x9fea71e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0099.889] GetProcessHeap () returned 0x840000 [0099.889] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9fea71e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x9fea71e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.890] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9fea71e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x9fea71e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.890] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.890] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea71e0, ftCreationTime.dwHighDateTime=0x1d581c5, ftLastAccessTime.dwLowDateTime=0x9fea71e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x773ea820, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="svchost.exe", cAlternateFileName="")) returned 1 [0099.890] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea71e0, ftCreationTime.dwHighDateTime=0x1d581c5, ftLastAccessTime.dwLowDateTime=0x9fea71e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x773ea820, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="svchost.exe", cAlternateFileName="")) returned 0 [0099.890] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.890] GetProcessHeap () returned 0x840000 [0099.890] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.890] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0099.890] GetProcessHeap () returned 0x840000 [0099.890] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.893] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.893] GetProcessHeap () returned 0x840000 [0099.893] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.894] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.895] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.896] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.896] GetProcessHeap () returned 0x840000 [0099.896] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.896] GetProcessHeap () returned 0x840000 [0099.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.896] GetProcessHeap () returned 0x840000 [0099.896] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.897] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.897] GetProcessHeap () returned 0x840000 [0099.897] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.897] GetProcessHeap () returned 0x840000 [0099.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.897] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.897] GetProcessHeap () returned 0x840000 [0099.897] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.897] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.897] GetProcessHeap () returned 0x840000 [0099.897] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.897] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0099.897] GetProcessHeap () returned 0x840000 [0099.897] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0099.897] GetProcessHeap () returned 0x840000 [0099.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0099.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f6524e0, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x9f6524e0, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0099.898] GetProcessHeap () returned 0x840000 [0099.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.898] GetProcessHeap () returned 0x840000 [0099.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.898] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.898] GetProcessHeap () returned 0x840000 [0099.898] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.898] GetProcessHeap () returned 0x840000 [0099.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.898] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.898] GetProcessHeap () returned 0x840000 [0099.898] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.898] GetProcessHeap () returned 0x840000 [0099.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.899] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.899] GetProcessHeap () returned 0x840000 [0099.899] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0099.899] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.899] GetProcessHeap () returned 0x840000 [0099.899] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.899] GetProcessHeap () returned 0x840000 [0099.899] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.899] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.899] GetProcessHeap () returned 0x840000 [0099.899] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.899] GetProcessHeap () returned 0x840000 [0099.899] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.899] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0099.900] GetProcessHeap () returned 0x840000 [0099.900] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0099.900] GetProcessHeap () returned 0x840000 [0099.900] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0099.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0099.900] GetProcessHeap () returned 0x840000 [0099.900] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0099.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0099.900] GetProcessHeap () returned 0x840000 [0099.900] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.901] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.901] GetProcessHeap () returned 0x840000 [0099.901] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.901] GetProcessHeap () returned 0x840000 [0099.901] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.901] GetProcessHeap () returned 0x840000 [0099.902] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0099.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0099.902] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0099.902] GetProcessHeap () returned 0x840000 [0099.902] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0099.902] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.902] GetProcessHeap () returned 0x840000 [0099.902] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.902] GetProcessHeap () returned 0x840000 [0099.902] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.902] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.902] GetProcessHeap () returned 0x840000 [0099.902] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.902] GetProcessHeap () returned 0x840000 [0099.902] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0099.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0099.998] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0099.999] GetProcessHeap () returned 0x840000 [0099.999] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0099.999] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0099.999] GetProcessHeap () returned 0x840000 [0099.999] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.000] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.000] GetProcessHeap () returned 0x840000 [0100.000] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.000] GetProcessHeap () returned 0x840000 [0100.000] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.001] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.001] GetProcessHeap () returned 0x840000 [0100.001] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.001] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.001] GetProcessHeap () returned 0x840000 [0100.001] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.001] GetProcessHeap () returned 0x840000 [0100.001] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.001] GetProcessHeap () returned 0x840000 [0100.001] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.252] GetProcessHeap () returned 0x840000 [0100.252] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.252] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.252] GetProcessHeap () returned 0x840000 [0100.252] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.252] GetProcessHeap () returned 0x840000 [0100.252] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.252] GetProcessHeap () returned 0x840000 [0100.252] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.254] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.254] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0100.254] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0100.254] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0100.255] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0100.255] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0100.255] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.255] GetProcessHeap () returned 0x840000 [0100.255] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.255] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0100.255] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.255] GetProcessHeap () returned 0x840000 [0100.255] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.256] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1 [0100.256] GetProcessHeap () returned 0x840000 [0100.257] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.370] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.370] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.370] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.370] GetProcessHeap () returned 0x840000 [0100.370] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.370] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1 [0100.370] GetProcessHeap () returned 0x840000 [0100.370] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.371] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.371] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.371] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.371] GetProcessHeap () returned 0x840000 [0100.371] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.371] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0100.371] GetProcessHeap () returned 0x840000 [0100.371] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.372] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.372] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.372] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.372] GetProcessHeap () returned 0x840000 [0100.372] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.372] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0100.372] GetProcessHeap () returned 0x840000 [0100.372] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.372] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.372] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0100.372] GetProcessHeap () returned 0x840000 [0100.372] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.453] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.453] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0100.453] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0100.453] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.454] GetProcessHeap () returned 0x840000 [0100.454] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.454] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0100.454] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.454] GetProcessHeap () returned 0x840000 [0100.454] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.455] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0100.455] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.455] GetProcessHeap () returned 0x840000 [0100.455] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.456] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0100.456] GetProcessHeap () returned 0x840000 [0100.456] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.456] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0100.457] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0100.457] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.457] GetProcessHeap () returned 0x840000 [0100.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.457] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0100.457] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.457] GetProcessHeap () returned 0x840000 [0100.457] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.457] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0100.457] GetProcessHeap () returned 0x840000 [0100.457] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.457] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.458] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0100.458] GetProcessHeap () returned 0x840000 [0100.458] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.458] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.458] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.458] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.458] GetProcessHeap () returned 0x840000 [0100.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.458] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0100.458] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.458] GetProcessHeap () returned 0x840000 [0100.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.458] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0100.458] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.458] GetProcessHeap () returned 0x840000 [0100.458] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.459] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0100.459] GetProcessHeap () returned 0x840000 [0100.459] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.464] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.465] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0100.465] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0100.465] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0100.465] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0100.465] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0100.466] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0100.467] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0100.467] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.468] GetProcessHeap () returned 0x840000 [0100.468] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.468] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0100.468] GetProcessHeap () returned 0x840000 [0100.468] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.468] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.468] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0100.469] GetProcessHeap () returned 0x840000 [0100.469] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.470] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.470] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1 [0100.470] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0 [0100.470] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.470] GetProcessHeap () returned 0x840000 [0100.470] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.470] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0100.470] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.470] GetProcessHeap () returned 0x840000 [0100.470] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.470] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0100.470] GetProcessHeap () returned 0x840000 [0100.470] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.470] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.470] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0100.470] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.470] GetProcessHeap () returned 0x840000 [0100.471] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.471] FindNextFileW (in: hFindFile=0x937998, lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0100.471] GetProcessHeap () returned 0x840000 [0100.471] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.472] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.473] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0100.473] GetProcessHeap () returned 0x840000 [0100.473] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.473] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.473] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.473] GetProcessHeap () returned 0x840000 [0100.473] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.474] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.474] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0100.474] GetProcessHeap () returned 0x840000 [0100.474] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.474] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.474] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0100.475] GetProcessHeap () returned 0x840000 [0100.475] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.476] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.476] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0100.476] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0100.476] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.476] GetProcessHeap () returned 0x840000 [0100.476] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.476] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0100.476] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.477] GetProcessHeap () returned 0x840000 [0100.477] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.480] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0100.480] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.480] GetProcessHeap () returned 0x840000 [0100.480] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.481] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.481] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.481] GetProcessHeap () returned 0x840000 [0100.481] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.481] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0100.481] GetProcessHeap () returned 0x840000 [0100.481] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.482] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.482] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.482] GetProcessHeap () returned 0x840000 [0100.482] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.482] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.482] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0100.482] GetProcessHeap () returned 0x840000 [0100.482] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.483] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.483] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0100.483] GetProcessHeap () returned 0x840000 [0100.483] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.484] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.484] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0100.484] FindNextFileW (in: hFindFile=0x937cd8, lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0100.484] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.484] GetProcessHeap () returned 0x840000 [0100.484] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.484] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0100.485] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.485] GetProcessHeap () returned 0x840000 [0100.485] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.486] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0100.486] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.486] GetProcessHeap () returned 0x840000 [0100.486] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.486] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.486] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.486] GetProcessHeap () returned 0x840000 [0100.486] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.486] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0100.486] GetProcessHeap () returned 0x840000 [0100.486] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.487] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.487] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.487] GetProcessHeap () returned 0x840000 [0100.487] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.577] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.577] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0100.577] GetProcessHeap () returned 0x840000 [0100.577] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.577] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.577] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.577] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.577] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.577] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.578] GetProcessHeap () returned 0x840000 [0100.578] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.578] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0100.578] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.578] GetProcessHeap () returned 0x840000 [0100.578] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.578] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.578] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.578] GetProcessHeap () returned 0x840000 [0100.578] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.578] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0100.578] GetProcessHeap () returned 0x840000 [0100.578] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.578] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.578] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0100.578] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0100.578] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0100.578] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.579] GetProcessHeap () returned 0x840000 [0100.579] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.579] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0100.579] GetProcessHeap () returned 0x840000 [0100.579] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.582] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.582] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.582] GetProcessHeap () returned 0x840000 [0100.582] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.583] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.583] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0100.583] GetProcessHeap () returned 0x840000 [0100.583] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.583] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.583] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.583] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.583] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.583] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.583] GetProcessHeap () returned 0x840000 [0100.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.583] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0100.583] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.583] GetProcessHeap () returned 0x840000 [0100.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.583] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.584] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.584] GetProcessHeap () returned 0x840000 [0100.584] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.584] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0100.584] GetProcessHeap () returned 0x840000 [0100.584] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.587] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.587] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0100.587] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0100.587] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0100.587] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.587] GetProcessHeap () returned 0x840000 [0100.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.587] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0100.588] GetProcessHeap () returned 0x840000 [0100.588] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.588] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.588] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.588] GetProcessHeap () returned 0x840000 [0100.588] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.588] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.588] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0100.588] GetProcessHeap () returned 0x840000 [0100.588] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.588] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.588] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.589] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.589] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.589] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.589] GetProcessHeap () returned 0x840000 [0100.589] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.589] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0100.589] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.589] GetProcessHeap () returned 0x840000 [0100.589] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.589] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.589] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.589] GetProcessHeap () returned 0x840000 [0100.589] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.589] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0100.590] GetProcessHeap () returned 0x840000 [0100.590] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.600] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.600] GetProcessHeap () returned 0x840000 [0100.600] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.600] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0100.600] GetProcessHeap () returned 0x840000 [0100.600] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.600] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.600] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.601] GetProcessHeap () returned 0x840000 [0100.601] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0100.601] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.601] GetProcessHeap () returned 0x840000 [0100.601] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.601] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.601] GetProcessHeap () returned 0x840000 [0100.601] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.601] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0100.601] GetProcessHeap () returned 0x840000 [0100.601] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.635] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.635] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.635] GetProcessHeap () returned 0x840000 [0100.635] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.635] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.635] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0100.635] GetProcessHeap () returned 0x840000 [0100.635] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.636] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.636] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.636] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.636] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.636] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.636] GetProcessHeap () returned 0x840000 [0100.636] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.636] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0100.637] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.637] GetProcessHeap () returned 0x840000 [0100.637] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.637] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.637] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.637] GetProcessHeap () returned 0x840000 [0100.637] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.637] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0100.637] GetProcessHeap () returned 0x840000 [0100.637] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.637] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.637] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.637] GetProcessHeap () returned 0x840000 [0100.637] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.637] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0100.638] GetProcessHeap () returned 0x840000 [0100.638] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.638] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.638] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.638] GetProcessHeap () returned 0x840000 [0100.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0100.638] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.638] GetProcessHeap () returned 0x840000 [0100.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.638] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.638] GetProcessHeap () returned 0x840000 [0100.638] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.638] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0100.639] GetProcessHeap () returned 0x840000 [0100.639] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.639] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.639] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.639] GetProcessHeap () returned 0x840000 [0100.639] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.639] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.639] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0100.639] GetProcessHeap () returned 0x840000 [0100.639] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.639] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.640] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.640] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.640] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.640] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.640] GetProcessHeap () returned 0x840000 [0100.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.640] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0100.640] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.640] GetProcessHeap () returned 0x840000 [0100.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.640] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.640] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.640] GetProcessHeap () returned 0x840000 [0100.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.640] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0100.640] GetProcessHeap () returned 0x840000 [0100.640] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.641] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.641] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.641] GetProcessHeap () returned 0x840000 [0100.641] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.642] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.642] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0100.642] GetProcessHeap () returned 0x840000 [0100.642] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.643] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.643] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.643] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.643] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.643] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.643] GetProcessHeap () returned 0x840000 [0100.643] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.643] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0100.643] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.643] GetProcessHeap () returned 0x840000 [0100.643] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.643] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.643] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.644] GetProcessHeap () returned 0x840000 [0100.644] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.644] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0100.644] GetProcessHeap () returned 0x840000 [0100.644] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.644] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.644] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.644] GetProcessHeap () returned 0x840000 [0100.644] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.645] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.645] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0100.645] GetProcessHeap () returned 0x840000 [0100.645] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.646] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.647] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.647] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.647] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.647] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.647] GetProcessHeap () returned 0x840000 [0100.647] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.647] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0100.647] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.647] GetProcessHeap () returned 0x840000 [0100.647] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.647] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.647] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.647] GetProcessHeap () returned 0x840000 [0100.647] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.647] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0100.647] GetProcessHeap () returned 0x840000 [0100.647] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.649] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.649] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0100.649] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0100.649] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0100.649] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.649] GetProcessHeap () returned 0x840000 [0100.649] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.649] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0100.649] GetProcessHeap () returned 0x840000 [0100.649] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.652] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.652] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.652] GetProcessHeap () returned 0x840000 [0100.652] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.652] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.652] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0100.652] GetProcessHeap () returned 0x840000 [0100.652] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.653] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.653] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.653] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.653] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.653] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.653] GetProcessHeap () returned 0x840000 [0100.653] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.653] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0100.653] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.653] GetProcessHeap () returned 0x840000 [0100.653] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.653] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.653] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.653] GetProcessHeap () returned 0x840000 [0100.653] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.653] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0100.653] GetProcessHeap () returned 0x840000 [0100.653] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.654] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.654] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0100.654] GetProcessHeap () returned 0x840000 [0100.654] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.655] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.655] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0100.655] GetProcessHeap () returned 0x840000 [0100.655] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.655] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.655] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0100.655] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0100.655] FindNextFileW (in: hFindFile=0x937b58, lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0100.655] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.655] GetProcessHeap () returned 0x840000 [0100.655] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.655] FindNextFileW (in: hFindFile=0x937c58, lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0100.655] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.655] GetProcessHeap () returned 0x840000 [0100.655] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.656] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0100.656] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.656] GetProcessHeap () returned 0x840000 [0100.656] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.656] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0100.656] GetProcessHeap () returned 0x840000 [0100.656] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.656] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.656] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0100.656] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0100.656] FindNextFileW (in: hFindFile=0x937bd8, lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0100.656] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.656] GetProcessHeap () returned 0x840000 [0100.656] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.656] FindNextFileW (in: hFindFile=0x937a98, lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0100.656] GetProcessHeap () returned 0x840000 [0100.656] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.658] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.658] GetProcessHeap () returned 0x840000 [0100.658] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.658] GetProcessHeap () returned 0x840000 [0100.658] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.659] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.659] GetProcessHeap () returned 0x840000 [0100.659] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.659] GetProcessHeap () returned 0x840000 [0100.659] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.659] GetProcessHeap () returned 0x840000 [0100.659] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.660] GetProcessHeap () returned 0x840000 [0100.660] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.660] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.660] GetProcessHeap () returned 0x840000 [0100.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.660] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.660] GetProcessHeap () returned 0x840000 [0100.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.660] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.660] GetProcessHeap () returned 0x840000 [0100.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.660] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.660] GetProcessHeap () returned 0x840000 [0100.660] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.661] GetProcessHeap () returned 0x840000 [0100.662] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Sun\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.758] GetProcessHeap () returned 0x840000 [0100.758] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.759] GetProcessHeap () returned 0x840000 [0100.759] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.760] FindClose (in: hFindFile=0x937c58 | out: hFindFile=0x937c58) returned 1 [0100.760] GetProcessHeap () returned 0x840000 [0100.760] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bad8b0 | out: hHeap=0x840000) returned 1 [0100.760] FindClose (in: hFindFile=0x937bd8 | out: hFindFile=0x937bd8) returned 1 [0100.764] GetProcessHeap () returned 0x840000 [0100.764] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2af0058 | out: hHeap=0x840000) returned 1 [0100.764] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.764] GetProcessHeap () returned 0x840000 [0100.764] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.765] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0100.765] GetProcessHeap () returned 0x840000 [0100.765] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0100.765] GetProcessHeap () returned 0x840000 [0100.765] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0100.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0100.811] GetProcessHeap () returned 0x840000 [0100.811] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.811] FindClose (in: hFindFile=0x937a98 | out: hFindFile=0x937a98) returned 1 [0100.811] GetProcessHeap () returned 0x840000 [0100.811] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2b942c8 | out: hHeap=0x840000) returned 1 [0100.811] FindClose (in: hFindFile=0x937998 | out: hFindFile=0x937998) returned 1 [0100.811] GetProcessHeap () returned 0x840000 [0100.811] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0100.811] GetProcessHeap () returned 0x840000 [0100.811] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0100.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="䗺@")) returned 0xffffffff [0100.812] GetProcessHeap () returned 0x840000 [0100.812] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8bff60 | out: hHeap=0x840000) returned 1 [0100.812] GetProcessHeap () returned 0x840000 [0100.812] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x8bff60 [0100.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x289f2f0 | out: lpFindFileData=0x289f2f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937998 [0100.812] GetProcessHeap () returned 0x840000 [0100.812] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b942c8 [0100.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x289f060 | out: lpFindFileData=0x289f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937a98 [0100.812] GetProcessHeap () returned 0x840000 [0100.812] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2af0058 [0100.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x289edd0 | out: lpFindFileData=0x289edd0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937bd8 [0100.813] GetProcessHeap () returned 0x840000 [0100.813] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bad8b0 [0100.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x289eb40 | out: lpFindFileData=0x289eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9fe81080, ftLastAccessTime.dwHighDateTime=0x1d581c5, ftLastWriteTime.dwLowDateTime=0x9fe81080, ftLastWriteTime.dwHighDateTime=0x1d581c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c58 [0100.813] GetProcessHeap () returned 0x840000 [0100.813] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.813] GetProcessHeap () returned 0x840000 [0100.813] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.814] GetProcessHeap () returned 0x840000 [0100.814] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0100.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0100.815] GetProcessHeap () returned 0x840000 [0100.815] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0100.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0100.894] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0100.894] GetProcessHeap () returned 0x840000 [0100.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0100.894] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0100.894] GetProcessHeap () returned 0x840000 [0100.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0100.894] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.894] GetProcessHeap () returned 0x840000 [0100.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.894] GetProcessHeap () returned 0x840000 [0100.894] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.894] GetProcessHeap () returned 0x840000 [0100.894] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0100.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0100.895] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0100.895] GetProcessHeap () returned 0x840000 [0100.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0100.895] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.895] GetProcessHeap () returned 0x840000 [0100.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.895] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.895] GetProcessHeap () returned 0x840000 [0100.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.897] GetProcessHeap () returned 0x840000 [0100.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.897] GetProcessHeap () returned 0x840000 [0100.897] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.898] GetProcessHeap () returned 0x840000 [0100.898] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0100.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0100.899] GetProcessHeap () returned 0x840000 [0100.899] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0100.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0100.900] GetProcessHeap () returned 0x840000 [0100.900] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0100.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0100.900] GetProcessHeap () returned 0x840000 [0100.900] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32b0068 [0100.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x289dbe0 | out: lpFindFileData=0x289dbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d98 [0100.901] GetProcessHeap () returned 0x840000 [0100.901] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32c0070 [0100.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x289d950 | out: lpFindFileData=0x289d950*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937dd8 [0100.908] FindClose (in: hFindFile=0x937dd8 | out: hFindFile=0x937dd8) returned 1 [0100.908] GetProcessHeap () returned 0x840000 [0100.908] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32c0070 | out: hHeap=0x840000) returned 1 [0100.908] FindClose (in: hFindFile=0x937d98 | out: hFindFile=0x937d98) returned 1 [0100.908] GetProcessHeap () returned 0x840000 [0100.908] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32b0068 | out: hHeap=0x840000) returned 1 [0100.908] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0100.908] GetProcessHeap () returned 0x840000 [0100.908] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0100.908] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0100.908] GetProcessHeap () returned 0x840000 [0100.908] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0100.908] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0100.908] GetProcessHeap () returned 0x840000 [0100.908] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0100.908] GetProcessHeap () returned 0x840000 [0100.908] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0100.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0100.908] GetProcessHeap () returned 0x840000 [0100.909] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0100.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0100.910] GetProcessHeap () returned 0x840000 [0100.910] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0100.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0100.911] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0100.911] GetProcessHeap () returned 0x840000 [0100.911] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0100.911] GetProcessHeap () returned 0x840000 [0100.911] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0100.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0100.913] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0100.914] GetProcessHeap () returned 0x840000 [0100.914] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0100.914] GetProcessHeap () returned 0x840000 [0100.914] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0100.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0100.915] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0100.916] GetProcessHeap () returned 0x840000 [0100.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0100.916] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0100.916] GetProcessHeap () returned 0x840000 [0100.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0100.916] FindClose (in: hFindFile=0x937c98 | out: hFindFile=0x937c98) returned 1 [0100.916] GetProcessHeap () returned 0x840000 [0100.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3280050 | out: hHeap=0x840000) returned 1 [0100.916] FindClose (in: hFindFile=0x937cd8 | out: hFindFile=0x937cd8) returned 1 [0100.916] GetProcessHeap () returned 0x840000 [0100.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3270048 | out: hHeap=0x840000) returned 1 [0100.916] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.916] GetProcessHeap () returned 0x840000 [0100.916] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.918] GetProcessHeap () returned 0x840000 [0100.918] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.919] FindClose (in: hFindFile=0x937b58 | out: hFindFile=0x937b58) returned 1 [0100.919] GetProcessHeap () returned 0x840000 [0100.919] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x2bbd8b8 | out: hHeap=0x840000) returned 1 [0100.919] GetProcessHeap () returned 0x840000 [0100.919] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2bbd8b8 [0100.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x289e8b0 | out: lpFindFileData=0x289e8b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937b58 [0100.919] GetProcessHeap () returned 0x840000 [0100.919] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3270048 [0100.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x289e620 | out: lpFindFileData=0x289e620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937cd8 [0100.920] GetProcessHeap () returned 0x840000 [0100.920] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3280050 [0100.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x289e390 | out: lpFindFileData=0x289e390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937c98 [0100.924] GetProcessHeap () returned 0x840000 [0100.924] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0100.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0100.924] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0100.924] GetProcessHeap () returned 0x840000 [0100.925] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0100.925] GetProcessHeap () returned 0x840000 [0100.925] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0100.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0100.925] GetProcessHeap () returned 0x840000 [0100.925] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0100.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0100.926] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0100.926] GetProcessHeap () returned 0x840000 [0100.926] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0100.926] FindClose (in: hFindFile=0x937d18 | out: hFindFile=0x937d18) returned 1 [0100.926] GetProcessHeap () returned 0x840000 [0100.926] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x3290058 | out: hHeap=0x840000) returned 1 [0100.926] GetProcessHeap () returned 0x840000 [0100.926] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x3290058 [0100.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x289e100 | out: lpFindFileData=0x289e100*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d18 [0101.366] GetProcessHeap () returned 0x840000 [0101.366] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0101.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0101.408] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0101.408] GetProcessHeap () returned 0x840000 [0101.408] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0101.408] GetProcessHeap () returned 0x840000 [0101.408] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0101.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x289de70 | out: lpFindFileData=0x289de70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x937d58 [0101.723] FindClose (in: hFindFile=0x937d58 | out: hFindFile=0x937d58) returned 1 [0101.723] GetProcessHeap () returned 0x840000 [0101.723] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x32a0060 | out: hHeap=0x840000) returned 1 [0101.723] GetProcessHeap () returned 0x840000 [0101.723] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x32a0060 [0101.723] FindFirstFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x289de70) Thread: id = 13 os_tid = 0xb08 [0079.822] GetProcessHeap () returned 0x840000 [0079.822] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b22080 [0079.822] GetProcessHeap () returned 0x840000 [0079.822] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b32088 [0079.822] GetProcessHeap () returned 0x840000 [0079.822] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x9048d0 [0079.822] GetProcessHeap () returned 0x840000 [0079.823] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x110102) returned 0x2bd0020 [0079.823] GetProcessHeap () returned 0x840000 [0079.823] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0079.823] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0079.823] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0079.823] Wow64DisableWow64FsRedirection (in: OldValue=0x284ff58 | out: OldValue=0x284ff58*=0x0) returned 1 [0079.823] GetProcessHeap () returned 0x840000 [0079.823] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0079.823] SetEvent (hEvent=0x144) returned 1 [0079.823] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0079.823] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=129) returned 1 [0079.823] CloseHandle (hObject=0x1ac) returned 1 [0079.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0079.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0079.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.824] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0079.824] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.824] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.824] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1b0 [0079.824] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x81, lpOverlapped=0x0) returned 1 [0079.838] WriteFile (in: hFile=0x1b0, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x90, lpOverlapped=0x0) returned 1 [0079.838] WriteFile (in: hFile=0x1b0, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0079.839] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0079.839] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0079.839] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x81, lpOverlapped=0x0) returned 1 [0079.839] FlushFileBuffers (hFile=0x1ac) returned 1 [0079.935] FlushFileBuffers (hFile=0x1b0) returned 1 [0079.942] CloseHandle (hObject=0x1ac) returned 1 [0079.943] CloseHandle (hObject=0x1b0) returned 1 [0079.945] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0079.946] SetEvent (hEvent=0x144) returned 1 [0079.946] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.946] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=89168) returned 1 [0079.946] CloseHandle (hObject=0x1b0) returned 1 [0079.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0079.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0079.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.947] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.947] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.947] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=87616) returned 1 [0079.947] CloseHandle (hObject=0x1b0) returned 1 [0079.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0079.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0079.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.947] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.948] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.948] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=91712) returned 1 [0079.948] CloseHandle (hObject=0x1b0) returned 1 [0079.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0079.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0079.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.948] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.948] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.948] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=94800) returned 1 [0079.949] CloseHandle (hObject=0x1b0) returned 1 [0079.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0079.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0079.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.949] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.949] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.949] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=85056) returned 1 [0079.949] CloseHandle (hObject=0x1b0) returned 1 [0079.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0079.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0079.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.949] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.950] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.950] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=43600) returned 1 [0079.950] CloseHandle (hObject=0x1b0) returned 1 [0079.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0079.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0079.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.950] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.950] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.950] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90192) returned 1 [0079.951] CloseHandle (hObject=0x1b0) returned 1 [0079.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0079.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0079.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.951] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=89152) returned 1 [0079.951] CloseHandle (hObject=0x1b0) returned 1 [0079.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0079.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0079.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.952] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.952] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=3694080) returned 1 [0079.952] CloseHandle (hObject=0x1b0) returned 1 [0079.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0079.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0 [0079.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0079.952] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.954] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=3876772) returned 1 [0079.954] CloseHandle (hObject=0x1b0) returned 1 [0079.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0079.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0 [0079.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0079.954] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.955] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1984228) returned 1 [0079.955] CloseHandle (hObject=0x1b0) returned 1 [0079.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0079.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0 [0079.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0079.955] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.955] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2371360) returned 1 [0079.955] CloseHandle (hObject=0x1b0) returned 1 [0079.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0079.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0 [0079.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0079.956] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.956] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=47452) returned 1 [0079.956] CloseHandle (hObject=0x1b0) returned 1 [0079.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0079.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0079.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.956] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.956] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.956] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=93248) returned 1 [0079.957] CloseHandle (hObject=0x1b0) returned 1 [0079.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0079.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0079.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.957] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.957] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.957] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90688) returned 1 [0079.957] CloseHandle (hObject=0x1b0) returned 1 [0079.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0079.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0079.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.958] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90704) returned 1 [0079.958] CloseHandle (hObject=0x1b0) returned 1 [0079.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0079.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0079.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.959] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=76352) returned 1 [0079.959] CloseHandle (hObject=0x1b0) returned 1 [0079.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0079.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0079.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.959] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=75344) returned 1 [0079.959] CloseHandle (hObject=0x1b0) returned 1 [0079.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0079.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0079.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.960] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=485760) returned 1 [0079.960] CloseHandle (hObject=0x1b0) returned 1 [0079.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0079.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0079.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.961] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=88144) returned 1 [0079.961] CloseHandle (hObject=0x1b0) returned 1 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.961] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.961] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.961] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90704) returned 1 [0079.961] CloseHandle (hObject=0x1b0) returned 1 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0079.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.962] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90704) returned 1 [0079.962] CloseHandle (hObject=0x1b0) returned 1 [0079.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0079.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0079.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.963] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90176) returned 1 [0079.963] CloseHandle (hObject=0x1b0) returned 1 [0079.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0079.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0079.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.963] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=89664) returned 1 [0079.963] CloseHandle (hObject=0x1b0) returned 1 [0079.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0079.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0079.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.964] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=90192) returned 1 [0079.964] CloseHandle (hObject=0x1b0) returned 1 [0079.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0079.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0079.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.965] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=87616) returned 1 [0079.965] CloseHandle (hObject=0x1b0) returned 1 [0079.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0079.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0079.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.965] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=87104) returned 1 [0079.965] CloseHandle (hObject=0x1b0) returned 1 [0079.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0079.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0079.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.966] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=70720) returned 1 [0079.966] CloseHandle (hObject=0x1b0) returned 1 [0079.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0079.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0079.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.967] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=70224) returned 1 [0079.967] CloseHandle (hObject=0x1b0) returned 1 [0079.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0079.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0079.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.967] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=70208) returned 1 [0079.967] CloseHandle (hObject=0x1b0) returned 1 [0079.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0079.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0079.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.968] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.968] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.968] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=383786) returned 1 [0079.968] CloseHandle (hObject=0x1b0) returned 1 [0079.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0079.968] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0079.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0079.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootmgr.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.968] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.969] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0079.969] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.970] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=8192) returned 1 [0079.970] CloseHandle (hObject=0x1b0) returned 1 [0079.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0079.970] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0079.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x26 [0079.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootsect.bak.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.970] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.970] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.970] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.970] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootsect.bak.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1ac [0079.971] ReadFile (in: hFile=0x1b0, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2000, lpOverlapped=0x0) returned 1 [0079.972] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2010, lpOverlapped=0x0) returned 1 [0079.974] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0079.975] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0079.975] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0079.975] WriteFile (in: hFile=0x1b0, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2000, lpOverlapped=0x0) returned 1 [0079.975] FlushFileBuffers (hFile=0x1b0) returned 1 [0079.985] FlushFileBuffers (hFile=0x1ac) returned 1 [0079.986] CloseHandle (hObject=0x1b0) returned 1 [0079.987] CloseHandle (hObject=0x1ac) returned 1 [0079.988] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0079.989] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2275].[checkcheck07@qq.com].Adame", dwFileAttributes=0x27) returned 1 [0079.989] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.990] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0079.990] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=16972987) returned 1 [0079.990] CloseHandle (hObject=0x1ac) returned 1 [0079.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0079.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0079.994] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0079.994] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0079.994] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0079.994] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0079.999] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0079.999] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0080.002] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0080.002] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0080.016] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.016] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0080.028] SetEndOfFile (hFile=0x1ac) returned 1 [0080.154] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0080.154] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0080.156] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0080.156] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0080.157] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0080.157] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0080.158] FlushFileBuffers (hFile=0x1ac) returned 1 [0081.448] CloseHandle (hObject=0x1ac) returned 1 [0082.370] SetEvent (hEvent=0x144) returned 1 [0082.371] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.372] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1565) returned 1 [0082.372] CloseHandle (hObject=0x1ac) returned 1 [0082.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0082.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0082.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.372] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.372] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.372] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.372] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1f8 [0082.372] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x61d, lpOverlapped=0x0) returned 1 [0082.374] WriteFile (in: hFile=0x1f8, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x620, lpOverlapped=0x0) returned 1 [0082.375] WriteFile (in: hFile=0x1f8, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0082.375] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0082.375] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0082.375] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x61d, lpOverlapped=0x0) returned 1 [0082.375] FlushFileBuffers (hFile=0x1ac) returned 1 [0082.377] FlushFileBuffers (hFile=0x1f8) returned 1 [0082.379] CloseHandle (hObject=0x1ac) returned 1 [0082.379] CloseHandle (hObject=0x1f8) returned 1 [0082.381] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0082.382] SetEvent (hEvent=0x144) returned 1 [0082.382] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0082.382] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2296) returned 1 [0082.382] CloseHandle (hObject=0x1f8) returned 1 [0082.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0082.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0082.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.383] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0082.383] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.383] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.383] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0082.383] ReadFile (in: hFile=0x1f8, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x8f8, lpOverlapped=0x0) returned 1 [0082.385] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x900, lpOverlapped=0x0) returned 1 [0082.386] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0082.387] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0082.387] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0082.387] WriteFile (in: hFile=0x1f8, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x8f8, lpOverlapped=0x0) returned 1 [0082.387] FlushFileBuffers (hFile=0x1f8) returned 1 [0082.389] FlushFileBuffers (hFile=0x1ac) returned 1 [0082.390] CloseHandle (hObject=0x1f8) returned 1 [0082.391] CloseHandle (hObject=0x1ac) returned 1 [0082.392] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0082.394] SetEvent (hEvent=0x144) returned 1 [0082.395] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.396] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2503680) returned 1 [0082.396] CloseHandle (hObject=0x1ac) returned 1 [0082.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0082.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0082.397] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.397] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0082.397] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0082.397] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0082.401] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0082.401] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0082.411] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0082.411] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0082.424] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.424] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0082.583] SetEndOfFile (hFile=0x1ac) returned 1 [0082.583] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0082.583] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0082.586] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0082.586] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0082.590] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0082.590] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0082.591] FlushFileBuffers (hFile=0x1ac) returned 1 [0083.697] CloseHandle (hObject=0x1ac) returned 1 [0083.842] SetEvent (hEvent=0x144) returned 1 [0083.843] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0083.843] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1886) returned 1 [0083.843] CloseHandle (hObject=0x1ac) returned 1 [0083.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0083.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0083.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0083.843] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0083.843] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.843] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.843] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x20c [0083.844] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x75e, lpOverlapped=0x0) returned 1 [0083.845] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x760, lpOverlapped=0x0) returned 1 [0083.846] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0083.846] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0083.846] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0083.846] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x75e, lpOverlapped=0x0) returned 1 [0083.847] FlushFileBuffers (hFile=0x1ac) returned 1 [0083.849] FlushFileBuffers (hFile=0x20c) returned 1 [0083.850] CloseHandle (hObject=0x1ac) returned 1 [0083.851] CloseHandle (hObject=0x20c) returned 1 [0083.852] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0083.853] SetEvent (hEvent=0x144) returned 1 [0083.853] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0083.855] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2513920) returned 1 [0083.855] CloseHandle (hObject=0x20c) returned 1 [0083.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0083.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0083.855] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0083.855] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0083.855] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0083.856] ReadFile (in: hFile=0x20c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0083.859] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0083.859] ReadFile (in: hFile=0x20c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0083.868] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0083.868] ReadFile (in: hFile=0x20c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0083.881] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.881] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0084.016] SetEndOfFile (hFile=0x20c) returned 1 [0084.016] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0084.017] WriteFile (in: hFile=0x20c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0084.019] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0084.019] WriteFile (in: hFile=0x20c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0084.022] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0084.022] WriteFile (in: hFile=0x20c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0084.024] FlushFileBuffers (hFile=0x20c) returned 1 [0084.998] CloseHandle (hObject=0x20c) returned 1 [0085.210] SetEvent (hEvent=0x144) returned 1 [0085.211] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0085.211] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1450) returned 1 [0085.211] CloseHandle (hObject=0x20c) returned 1 [0085.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0085.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0085.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.211] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0085.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.211] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0085.212] ReadFile (in: hFile=0x20c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x5aa, lpOverlapped=0x0) returned 1 [0085.213] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x5b0, lpOverlapped=0x0) returned 1 [0085.214] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x102, lpOverlapped=0x0) returned 1 [0085.214] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0085.214] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0085.214] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x5aa, lpOverlapped=0x0) returned 1 [0085.215] FlushFileBuffers (hFile=0x20c) returned 1 [0085.723] FlushFileBuffers (hFile=0x1ac) returned 1 [0085.925] CloseHandle (hObject=0x20c) returned 1 [0085.925] CloseHandle (hObject=0x1ac) returned 1 [0085.926] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0085.927] SetEvent (hEvent=0x144) returned 1 [0085.928] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0085.928] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1608) returned 1 [0085.928] CloseHandle (hObject=0x1ac) returned 1 [0085.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0085.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0085.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.928] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0085.928] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.928] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.929] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x20c [0085.929] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x648, lpOverlapped=0x0) returned 1 [0085.930] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x650, lpOverlapped=0x0) returned 1 [0085.931] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0085.931] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0085.932] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0085.932] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x648, lpOverlapped=0x0) returned 1 [0085.932] FlushFileBuffers (hFile=0x1ac) returned 1 [0085.937] FlushFileBuffers (hFile=0x20c) returned 1 [0085.938] CloseHandle (hObject=0x1ac) returned 1 [0085.939] CloseHandle (hObject=0x20c) returned 1 [0085.942] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0085.943] SetEvent (hEvent=0x144) returned 1 [0085.943] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0085.944] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=14819276) returned 1 [0085.944] CloseHandle (hObject=0x20c) returned 1 [0085.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0085.944] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0085.944] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0085.944] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0085.944] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0085.944] ReadFile (in: hFile=0x20c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0085.949] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0085.949] ReadFile (in: hFile=0x20c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0085.952] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0085.952] ReadFile (in: hFile=0x20c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0085.965] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.965] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0085.978] SetEndOfFile (hFile=0x20c) returned 1 [0085.978] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0085.978] WriteFile (in: hFile=0x20c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0085.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0085.980] WriteFile (in: hFile=0x20c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0085.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0085.980] WriteFile (in: hFile=0x20c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0085.981] FlushFileBuffers (hFile=0x20c) returned 1 [0086.836] CloseHandle (hObject=0x20c) returned 1 [0087.933] SetEvent (hEvent=0x144) returned 1 [0087.934] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0087.935] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=3186) returned 1 [0087.935] CloseHandle (hObject=0x1ac) returned 1 [0087.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0087.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0087.935] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0087.935] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0087.935] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.935] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.935] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x210 [0087.936] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xc72, lpOverlapped=0x0) returned 1 [0087.937] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xc80, lpOverlapped=0x0) returned 1 [0087.947] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0087.947] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0087.947] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0087.947] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xc72, lpOverlapped=0x0) returned 1 [0087.947] FlushFileBuffers (hFile=0x1ac) returned 1 [0087.949] FlushFileBuffers (hFile=0x210) returned 1 [0087.951] CloseHandle (hObject=0x1ac) returned 1 [0087.951] CloseHandle (hObject=0x210) returned 1 [0087.952] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0087.953] SetEvent (hEvent=0x144) returned 1 [0087.953] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.953] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=4207) returned 1 [0087.953] CloseHandle (hObject=0x210) returned 1 [0087.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0087.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0087.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0087.954] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.954] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.954] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.954] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0087.954] ReadFile (in: hFile=0x210, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x106f, lpOverlapped=0x0) returned 1 [0087.956] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x1070, lpOverlapped=0x0) returned 1 [0087.958] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0087.958] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0087.958] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0087.958] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x106f, lpOverlapped=0x0) returned 1 [0087.958] FlushFileBuffers (hFile=0x210) returned 1 [0087.960] FlushFileBuffers (hFile=0x1ac) returned 1 [0087.962] CloseHandle (hObject=0x210) returned 1 [0087.963] CloseHandle (hObject=0x1ac) returned 1 [0087.964] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0087.965] SetEvent (hEvent=0x144) returned 1 [0087.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0087.965] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2424) returned 1 [0087.965] CloseHandle (hObject=0x1ac) returned 1 [0087.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0087.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0087.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0087.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0087.965] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.965] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.966] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x210 [0087.967] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x978, lpOverlapped=0x0) returned 1 [0087.968] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x980, lpOverlapped=0x0) returned 1 [0087.969] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0087.970] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0087.970] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0087.970] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x978, lpOverlapped=0x0) returned 1 [0087.970] FlushFileBuffers (hFile=0x1ac) returned 1 [0087.972] FlushFileBuffers (hFile=0x210) returned 1 [0087.974] CloseHandle (hObject=0x1ac) returned 1 [0087.974] CloseHandle (hObject=0x210) returned 1 [0087.975] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0087.976] SetEvent (hEvent=0x144) returned 1 [0087.976] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.976] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=43806141) returned 1 [0087.976] CloseHandle (hObject=0x210) returned 1 [0087.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0087.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0087.977] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0087.977] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0087.977] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0087.977] ReadFile (in: hFile=0x210, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0087.983] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0087.983] ReadFile (in: hFile=0x210, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0087.987] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0087.987] ReadFile (in: hFile=0x210, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0087.999] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.999] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0088.014] SetEndOfFile (hFile=0x210) returned 1 [0088.015] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0088.015] WriteFile (in: hFile=0x210, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0088.135] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0088.135] WriteFile (in: hFile=0x210, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0088.137] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0088.137] WriteFile (in: hFile=0x210, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0088.138] FlushFileBuffers (hFile=0x210) returned 1 [0088.858] CloseHandle (hObject=0x210) returned 1 [0089.617] SetEvent (hEvent=0x144) returned 1 [0089.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.618] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1800) returned 1 [0089.618] CloseHandle (hObject=0x210) returned 1 [0089.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0089.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0089.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0089.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0089.618] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.618] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0089.619] ReadFile (in: hFile=0x210, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x708, lpOverlapped=0x0) returned 1 [0089.620] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x710, lpOverlapped=0x0) returned 1 [0089.621] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0089.621] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0089.621] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0089.621] WriteFile (in: hFile=0x210, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x708, lpOverlapped=0x0) returned 1 [0089.621] FlushFileBuffers (hFile=0x210) returned 1 [0089.625] FlushFileBuffers (hFile=0x1ac) returned 1 [0089.626] CloseHandle (hObject=0x210) returned 1 [0089.627] CloseHandle (hObject=0x1ac) returned 1 [0089.628] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0089.629] SetEvent (hEvent=0x144) returned 1 [0089.629] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0089.631] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=11482605) returned 1 [0089.631] CloseHandle (hObject=0x1ac) returned 1 [0089.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0089.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0089.631] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0089.631] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0089.631] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0089.632] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0089.636] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0089.636] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0089.638] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0089.638] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0089.651] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.651] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0089.725] SetEndOfFile (hFile=0x1ac) returned 1 [0089.725] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0089.725] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0089.727] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0089.727] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0089.741] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0089.741] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0089.741] FlushFileBuffers (hFile=0x1ac) returned 1 [0090.527] CloseHandle (hObject=0x1ac) returned 1 [0091.463] SetEvent (hEvent=0x144) returned 1 [0091.464] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0091.464] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=881152) returned 1 [0091.464] CloseHandle (hObject=0x1ac) returned 1 [0091.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0091.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0091.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.465] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0091.465] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.465] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.465] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x20c [0091.480] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xd7200, lpOverlapped=0x0) returned 1 [0091.495] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xd7210, lpOverlapped=0x0) returned 1 [0091.529] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0091.529] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0091.529] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0091.529] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xd7200, lpOverlapped=0x0) returned 1 [0091.532] FlushFileBuffers (hFile=0x1ac) returned 1 [0091.682] FlushFileBuffers (hFile=0x20c) returned 1 [0091.951] CloseHandle (hObject=0x1ac) returned 1 [0091.956] CloseHandle (hObject=0x20c) returned 1 [0091.966] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0091.974] SetEvent (hEvent=0x144) returned 1 [0091.974] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0091.974] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1457) returned 1 [0091.974] CloseHandle (hObject=0x20c) returned 1 [0091.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0091.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0091.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.975] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0091.975] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.975] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.975] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0091.975] ReadFile (in: hFile=0x20c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x5b1, lpOverlapped=0x0) returned 1 [0092.011] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x5c0, lpOverlapped=0x0) returned 1 [0092.012] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0092.013] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.013] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.013] WriteFile (in: hFile=0x20c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x5b1, lpOverlapped=0x0) returned 1 [0092.013] FlushFileBuffers (hFile=0x20c) returned 1 [0092.019] FlushFileBuffers (hFile=0x1ac) returned 1 [0092.032] CloseHandle (hObject=0x20c) returned 1 [0092.033] CloseHandle (hObject=0x1ac) returned 1 [0092.033] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0092.034] SetEvent (hEvent=0x144) returned 1 [0092.034] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0092.034] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=21064532) returned 1 [0092.035] CloseHandle (hObject=0x1ac) returned 1 [0092.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0092.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0092.035] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0092.035] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.035] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.035] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0092.041] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.041] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0092.045] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.045] ReadFile (in: hFile=0x1ac, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0092.062] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.063] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0092.078] SetEndOfFile (hFile=0x1ac) returned 1 [0092.078] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0092.078] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0092.080] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0092.080] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0092.080] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0092.081] WriteFile (in: hFile=0x1ac, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0092.081] FlushFileBuffers (hFile=0x1ac) returned 1 [0092.613] CloseHandle (hObject=0x1ac) returned 1 [0092.614] SetEvent (hEvent=0x144) returned 1 [0092.614] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0092.615] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1458) returned 1 [0092.615] CloseHandle (hObject=0x1ac) returned 1 [0092.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0092.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0092.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.615] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0092.615] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.615] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.615] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0092.615] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x5b2, lpOverlapped=0x0) returned 1 [0092.617] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x5c0, lpOverlapped=0x0) returned 1 [0092.618] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0092.618] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.618] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.618] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x5b2, lpOverlapped=0x0) returned 1 [0092.618] FlushFileBuffers (hFile=0x1ac) returned 1 [0092.621] FlushFileBuffers (hFile=0x19c) returned 1 [0092.623] CloseHandle (hObject=0x1ac) returned 1 [0092.623] CloseHandle (hObject=0x19c) returned 1 [0092.623] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0092.624] SetEvent (hEvent=0x144) returned 1 [0092.624] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0092.625] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=868864) returned 1 [0092.625] CloseHandle (hObject=0x19c) returned 1 [0092.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0092.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0092.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.625] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0092.625] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.625] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.625] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0092.625] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xd4200, lpOverlapped=0x0) returned 1 [0092.640] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xd4210, lpOverlapped=0x0) returned 1 [0092.654] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0092.654] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.655] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.655] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xd4200, lpOverlapped=0x0) returned 1 [0092.657] FlushFileBuffers (hFile=0x19c) returned 1 [0092.721] FlushFileBuffers (hFile=0x1ac) returned 1 [0092.792] CloseHandle (hObject=0x19c) returned 1 [0092.793] CloseHandle (hObject=0x1ac) returned 1 [0092.793] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0092.800] SetEvent (hEvent=0x144) returned 1 [0092.801] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0092.801] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1383) returned 1 [0092.801] CloseHandle (hObject=0x1ac) returned 1 [0092.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0092.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0092.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.801] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0092.801] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.801] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.801] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0092.802] ReadFile (in: hFile=0x1ac, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x567, lpOverlapped=0x0) returned 1 [0092.803] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x570, lpOverlapped=0x0) returned 1 [0092.804] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0092.805] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.805] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0092.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x567, lpOverlapped=0x0) returned 1 [0092.805] FlushFileBuffers (hFile=0x1ac) returned 1 [0092.809] FlushFileBuffers (hFile=0x19c) returned 1 [0092.811] CloseHandle (hObject=0x1ac) returned 1 [0092.811] CloseHandle (hObject=0x19c) returned 1 [0092.811] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0092.812] SetEvent (hEvent=0x144) returned 1 [0092.812] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0092.813] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2928955) returned 1 [0092.813] CloseHandle (hObject=0x19c) returned 1 [0092.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0092.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0092.813] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0092.813] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.813] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.813] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0092.817] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.817] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0092.826] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0092.826] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0092.840] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.840] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0092.885] SetEndOfFile (hFile=0x19c) returned 1 [0092.886] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0092.886] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0092.888] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0092.888] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0092.891] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0092.891] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0092.892] FlushFileBuffers (hFile=0x19c) returned 1 [0093.412] CloseHandle (hObject=0x19c) returned 1 [0093.412] SetEvent (hEvent=0x144) returned 1 [0093.413] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.413] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1852) returned 1 [0093.413] CloseHandle (hObject=0x19c) returned 1 [0093.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0093.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0093.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.415] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.415] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.415] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.415] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0093.415] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x73c, lpOverlapped=0x0) returned 1 [0093.417] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x740, lpOverlapped=0x0) returned 1 [0093.418] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0093.418] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0093.418] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0093.418] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x73c, lpOverlapped=0x0) returned 1 [0093.418] FlushFileBuffers (hFile=0x19c) returned 1 [0093.483] FlushFileBuffers (hFile=0x218) returned 1 [0093.546] CloseHandle (hObject=0x19c) returned 1 [0093.546] CloseHandle (hObject=0x218) returned 1 [0093.546] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0093.547] SetEvent (hEvent=0x144) returned 1 [0093.548] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0093.552] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=6241) returned 1 [0093.552] CloseHandle (hObject=0x218) returned 1 [0093.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0093.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0093.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.553] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0093.553] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.553] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.553] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0093.558] ReadFile (in: hFile=0x218, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x1861, lpOverlapped=0x0) returned 1 [0093.559] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x1870, lpOverlapped=0x0) returned 1 [0093.560] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0093.560] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0093.560] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0093.560] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x1861, lpOverlapped=0x0) returned 1 [0093.561] FlushFileBuffers (hFile=0x218) returned 1 [0093.563] FlushFileBuffers (hFile=0x19c) returned 1 [0093.565] CloseHandle (hObject=0x218) returned 1 [0093.565] CloseHandle (hObject=0x19c) returned 1 [0093.565] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0093.566] SetEvent (hEvent=0x144) returned 1 [0093.567] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.567] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=50823389) returned 1 [0093.567] CloseHandle (hObject=0x19c) returned 1 [0093.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0093.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.568] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.568] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.568] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.568] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0093.575] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.575] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0093.578] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.578] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0093.591] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.591] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0093.609] SetEndOfFile (hFile=0x19c) returned 1 [0093.609] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0093.609] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0093.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0093.611] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0093.612] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0093.612] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0093.613] FlushFileBuffers (hFile=0x19c) returned 1 [0093.754] CloseHandle (hObject=0x19c) returned 1 [0093.754] SetEvent (hEvent=0x144) returned 1 [0093.755] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.755] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=9503) returned 1 [0093.755] CloseHandle (hObject=0x19c) returned 1 [0093.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0093.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0093.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.755] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.756] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.756] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.756] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0093.756] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x251f, lpOverlapped=0x0) returned 1 [0093.757] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2520, lpOverlapped=0x0) returned 1 [0093.758] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0093.759] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0093.759] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x251f, lpOverlapped=0x0) returned 1 [0093.759] FlushFileBuffers (hFile=0x19c) returned 1 [0093.761] FlushFileBuffers (hFile=0x228) returned 1 [0093.762] CloseHandle (hObject=0x19c) returned 1 [0093.762] CloseHandle (hObject=0x228) returned 1 [0093.763] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0093.764] SetEvent (hEvent=0x144) returned 1 [0093.764] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0093.764] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2503680) returned 1 [0093.764] CloseHandle (hObject=0x228) returned 1 [0093.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0093.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.765] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0093.765] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.765] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.765] ReadFile (in: hFile=0x228, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0093.769] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.769] ReadFile (in: hFile=0x228, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0093.778] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0093.778] ReadFile (in: hFile=0x228, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0093.791] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.791] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0093.887] SetEndOfFile (hFile=0x228) returned 1 [0093.887] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0093.887] WriteFile (in: hFile=0x228, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0093.889] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0093.889] WriteFile (in: hFile=0x228, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0093.893] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0093.893] WriteFile (in: hFile=0x228, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0093.894] FlushFileBuffers (hFile=0x228) returned 1 [0094.068] CloseHandle (hObject=0x228) returned 1 [0094.069] SetEvent (hEvent=0x144) returned 1 [0094.069] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.072] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1452) returned 1 [0094.072] CloseHandle (hObject=0x228) returned 1 [0094.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0094.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0094.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.072] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.072] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.072] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.072] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0094.072] ReadFile (in: hFile=0x228, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x5ac, lpOverlapped=0x0) returned 1 [0094.075] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x5b0, lpOverlapped=0x0) returned 1 [0094.076] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0094.076] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0094.076] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0094.076] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x5ac, lpOverlapped=0x0) returned 1 [0094.076] FlushFileBuffers (hFile=0x228) returned 1 [0094.099] FlushFileBuffers (hFile=0x1c4) returned 1 [0094.101] CloseHandle (hObject=0x228) returned 1 [0094.101] CloseHandle (hObject=0x1c4) returned 1 [0094.102] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0094.103] SetEvent (hEvent=0x144) returned 1 [0094.103] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.104] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=8265165) returned 1 [0094.104] CloseHandle (hObject=0x1c4) returned 1 [0094.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0094.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0094.105] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.105] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.105] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.105] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.110] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.110] ReadFile (in: hFile=0x1c4, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.113] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.113] ReadFile (in: hFile=0x1c4, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.127] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.127] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0094.330] SetEndOfFile (hFile=0x1c4) returned 1 [0094.330] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.330] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.333] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.333] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.335] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.335] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.336] FlushFileBuffers (hFile=0x1c4) returned 1 [0094.471] CloseHandle (hObject=0x1c4) returned 1 [0094.471] SetEvent (hEvent=0x144) returned 1 [0094.472] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.472] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2507776) returned 1 [0094.472] CloseHandle (hObject=0x1c4) returned 1 [0094.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0094.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0094.473] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.473] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.473] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.473] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.477] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.477] ReadFile (in: hFile=0x1c4, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.486] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.486] ReadFile (in: hFile=0x1c4, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.499] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.499] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0094.516] SetEndOfFile (hFile=0x1c4) returned 1 [0094.516] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.516] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.518] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.518] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.525] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.525] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.526] FlushFileBuffers (hFile=0x1c4) returned 1 [0094.755] CloseHandle (hObject=0x1c4) returned 1 [0094.788] SetEvent (hEvent=0x144) returned 1 [0094.788] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.797] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1857) returned 1 [0094.797] CloseHandle (hObject=0x22c) returned 1 [0094.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0094.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0094.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.798] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.798] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.798] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.798] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0094.798] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x741, lpOverlapped=0x0) returned 1 [0094.800] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x750, lpOverlapped=0x0) returned 1 [0094.800] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x112, lpOverlapped=0x0) returned 1 [0094.801] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0094.801] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0094.801] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x741, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x741, lpOverlapped=0x0) returned 1 [0094.801] FlushFileBuffers (hFile=0x22c) returned 1 [0094.803] FlushFileBuffers (hFile=0x1c4) returned 1 [0094.804] CloseHandle (hObject=0x22c) returned 1 [0094.805] CloseHandle (hObject=0x1c4) returned 1 [0094.805] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0094.806] SetEvent (hEvent=0x144) returned 1 [0094.806] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.806] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=655872) returned 1 [0094.806] CloseHandle (hObject=0x1c4) returned 1 [0094.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0094.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0094.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.807] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.807] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.807] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.807] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0094.807] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xa0200, lpOverlapped=0x0) returned 1 [0094.819] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xa0210, lpOverlapped=0x0) returned 1 [0094.830] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0094.830] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0094.830] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0094.830] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xa0200, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xa0200, lpOverlapped=0x0) returned 1 [0094.831] FlushFileBuffers (hFile=0x1c4) returned 1 [0094.854] FlushFileBuffers (hFile=0x22c) returned 1 [0094.857] CloseHandle (hObject=0x1c4) returned 1 [0094.857] CloseHandle (hObject=0x22c) returned 1 [0094.857] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0094.863] SetEvent (hEvent=0x144) returned 1 [0094.863] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.863] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=14127746) returned 1 [0094.863] CloseHandle (hObject=0x22c) returned 1 [0094.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0094.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0094.864] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.864] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.864] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.864] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.869] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.869] ReadFile (in: hFile=0x22c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.872] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0094.872] ReadFile (in: hFile=0x22c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0094.884] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.884] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0094.915] SetEndOfFile (hFile=0x22c) returned 1 [0094.916] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.916] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.918] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.918] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.918] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0094.919] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0094.919] FlushFileBuffers (hFile=0x22c) returned 1 [0095.050] CloseHandle (hObject=0x22c) returned 1 [0095.050] SetEvent (hEvent=0x144) returned 1 [0095.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.053] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=5557) returned 1 [0095.053] CloseHandle (hObject=0x22c) returned 1 [0095.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0095.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0095.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.053] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.053] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x214 [0095.062] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x15b5, lpOverlapped=0x0) returned 1 [0095.064] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x15c0, lpOverlapped=0x0) returned 1 [0095.065] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0095.065] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.065] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.065] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x15b5, lpOverlapped=0x0) returned 1 [0095.065] FlushFileBuffers (hFile=0x22c) returned 1 [0095.068] FlushFileBuffers (hFile=0x214) returned 1 [0095.070] CloseHandle (hObject=0x22c) returned 1 [0095.070] CloseHandle (hObject=0x214) returned 1 [0095.070] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0095.071] SetEvent (hEvent=0x144) returned 1 [0095.071] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0095.072] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=819) returned 1 [0095.072] CloseHandle (hObject=0x214) returned 1 [0095.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0095.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0095.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0095.072] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.072] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0095.072] ReadFile (in: hFile=0x214, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x333, lpOverlapped=0x0) returned 1 [0095.074] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x340, lpOverlapped=0x0) returned 1 [0095.075] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x102, lpOverlapped=0x0) returned 1 [0095.075] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.075] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.075] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x333, lpOverlapped=0x0) returned 1 [0095.075] FlushFileBuffers (hFile=0x214) returned 1 [0095.144] FlushFileBuffers (hFile=0x22c) returned 1 [0095.151] CloseHandle (hObject=0x214) returned 1 [0095.151] CloseHandle (hObject=0x22c) returned 1 [0095.152] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0095.152] SetEvent (hEvent=0x144) returned 1 [0095.153] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.153] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=191872) returned 1 [0095.153] CloseHandle (hObject=0x22c) returned 1 [0095.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0095.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0095.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.154] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.154] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.154] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.154] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x214 [0095.154] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2ed80, lpOverlapped=0x0) returned 1 [0095.158] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2ed90, lpOverlapped=0x0) returned 1 [0095.162] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0095.162] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.162] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.162] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2ed80, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2ed80, lpOverlapped=0x0) returned 1 [0095.163] FlushFileBuffers (hFile=0x22c) returned 1 [0095.173] FlushFileBuffers (hFile=0x214) returned 1 [0095.175] CloseHandle (hObject=0x22c) returned 1 [0095.175] CloseHandle (hObject=0x214) returned 1 [0095.175] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0095.177] SetEvent (hEvent=0x144) returned 1 [0095.178] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0095.178] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=27195) returned 1 [0095.178] CloseHandle (hObject=0x214) returned 1 [0095.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0095.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0095.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.178] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0095.178] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.178] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.178] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0095.179] ReadFile (in: hFile=0x214, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x6a3b, lpOverlapped=0x0) returned 1 [0095.181] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x6a40, lpOverlapped=0x0) returned 1 [0095.182] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0095.182] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.182] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.182] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x6a3b, lpOverlapped=0x0) returned 1 [0095.183] FlushFileBuffers (hFile=0x214) returned 1 [0095.203] FlushFileBuffers (hFile=0x22c) returned 1 [0095.205] CloseHandle (hObject=0x214) returned 1 [0095.206] CloseHandle (hObject=0x22c) returned 1 [0095.206] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0095.207] SetEvent (hEvent=0x144) returned 1 [0095.207] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.207] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=9352) returned 1 [0095.207] CloseHandle (hObject=0x22c) returned 1 [0095.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0095.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0095.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.207] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.207] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.208] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.208] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x214 [0095.208] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2488, lpOverlapped=0x0) returned 1 [0095.209] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2490, lpOverlapped=0x0) returned 1 [0095.210] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0095.211] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.211] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.211] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2488, lpOverlapped=0x0) returned 1 [0095.211] FlushFileBuffers (hFile=0x22c) returned 1 [0095.213] FlushFileBuffers (hFile=0x214) returned 1 [0095.215] CloseHandle (hObject=0x22c) returned 1 [0095.215] CloseHandle (hObject=0x214) returned 1 [0095.215] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0095.216] SetEvent (hEvent=0x144) returned 1 [0095.216] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0095.216] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=3584) returned 1 [0095.216] CloseHandle (hObject=0x214) returned 1 [0095.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0095.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0095.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.217] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0095.217] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.217] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.217] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0095.217] ReadFile (in: hFile=0x214, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xe00, lpOverlapped=0x0) returned 1 [0095.218] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xe10, lpOverlapped=0x0) returned 1 [0095.219] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0095.219] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.220] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.220] WriteFile (in: hFile=0x214, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xe00, lpOverlapped=0x0) returned 1 [0095.220] FlushFileBuffers (hFile=0x214) returned 1 [0095.223] FlushFileBuffers (hFile=0x22c) returned 1 [0095.224] CloseHandle (hObject=0x214) returned 1 [0095.224] CloseHandle (hObject=0x22c) returned 1 [0095.224] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0095.225] SetEvent (hEvent=0x144) returned 1 [0095.225] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.227] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2517504) returned 1 [0095.227] CloseHandle (hObject=0x22c) returned 1 [0095.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0095.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0095.228] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.228] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.228] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.228] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.230] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.232] ReadFile (in: hFile=0x22c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.240] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.240] ReadFile (in: hFile=0x22c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.254] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.254] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0095.272] SetEndOfFile (hFile=0x22c) returned 1 [0095.272] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.272] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.274] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.274] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.278] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.278] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.279] FlushFileBuffers (hFile=0x22c) returned 1 [0095.397] CloseHandle (hObject=0x22c) returned 1 [0095.397] SetEvent (hEvent=0x144) returned 1 [0095.397] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.397] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=596341) returned 1 [0095.397] CloseHandle (hObject=0x22c) returned 1 [0095.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0095.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0095.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.398] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.398] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.398] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.398] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0095.398] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x91975, lpOverlapped=0x0) returned 1 [0095.409] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x91980, lpOverlapped=0x0) returned 1 [0095.421] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0095.422] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.422] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.422] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x91975, lpOverlapped=0x0) returned 1 [0095.423] FlushFileBuffers (hFile=0x22c) returned 1 [0095.447] FlushFileBuffers (hFile=0x19c) returned 1 [0095.450] CloseHandle (hObject=0x22c) returned 1 [0095.450] CloseHandle (hObject=0x19c) returned 1 [0095.450] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0095.455] SetEvent (hEvent=0x144) returned 1 [0095.456] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.456] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=868864) returned 1 [0095.456] CloseHandle (hObject=0x19c) returned 1 [0095.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0095.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0095.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.460] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.460] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.460] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.460] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0095.460] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xd4200, lpOverlapped=0x0) returned 1 [0095.476] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xd4210, lpOverlapped=0x0) returned 1 [0095.501] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x102, lpOverlapped=0x0) returned 1 [0095.501] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.501] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.501] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xd4200, lpOverlapped=0x0) returned 1 [0095.503] FlushFileBuffers (hFile=0x19c) returned 1 [0095.560] FlushFileBuffers (hFile=0x22c) returned 1 [0095.565] CloseHandle (hObject=0x19c) returned 1 [0095.565] CloseHandle (hObject=0x22c) returned 1 [0095.566] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0095.573] SetEvent (hEvent=0x144) returned 1 [0095.574] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.574] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=819) returned 1 [0095.574] CloseHandle (hObject=0x22c) returned 1 [0095.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0095.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0095.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.574] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.574] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.574] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.574] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0095.575] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x333, lpOverlapped=0x0) returned 1 [0095.577] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x340, lpOverlapped=0x0) returned 1 [0095.579] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x102, lpOverlapped=0x0) returned 1 [0095.579] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.579] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0095.579] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x333, lpOverlapped=0x0) returned 1 [0095.579] FlushFileBuffers (hFile=0x22c) returned 1 [0095.582] FlushFileBuffers (hFile=0x19c) returned 1 [0095.583] CloseHandle (hObject=0x22c) returned 1 [0095.583] CloseHandle (hObject=0x19c) returned 1 [0095.583] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0095.585] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.585] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1992192) returned 1 [0095.585] CloseHandle (hObject=0x19c) returned 1 [0095.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0095.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0095.586] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.586] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.586] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.586] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.591] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.591] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.594] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.594] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.606] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.606] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0095.639] SetEndOfFile (hFile=0x19c) returned 1 [0095.639] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.639] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.641] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.641] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.643] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.643] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.645] FlushFileBuffers (hFile=0x19c) returned 1 [0095.781] CloseHandle (hObject=0x19c) returned 1 [0095.781] SetEvent (hEvent=0x144) returned 1 [0095.782] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.782] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=36233052) returned 1 [0095.782] CloseHandle (hObject=0x19c) returned 1 [0095.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0095.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0095.783] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.783] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.783] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.783] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.787] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.787] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.792] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0095.793] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0095.805] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.805] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0095.825] SetEndOfFile (hFile=0x19c) returned 1 [0095.825] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.825] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.827] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.827] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.828] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0095.828] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0095.828] FlushFileBuffers (hFile=0x19c) returned 1 [0095.979] CloseHandle (hObject=0x19c) returned 1 [0095.979] SetEvent (hEvent=0x144) returned 1 [0095.980] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.980] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=715834) returned 1 [0095.980] CloseHandle (hObject=0x19c) returned 1 [0095.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0095.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0095.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.982] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.982] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.982] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.982] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0095.982] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xaec3a, lpOverlapped=0x0) returned 1 [0095.996] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xaec40, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x112, lpOverlapped=0x0) returned 1 [0096.011] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.011] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xaec3a, lpOverlapped=0x0) returned 1 [0096.013] FlushFileBuffers (hFile=0x19c) returned 1 [0096.056] FlushFileBuffers (hFile=0x218) returned 1 [0096.256] CloseHandle (hObject=0x19c) returned 1 [0096.257] CloseHandle (hObject=0x218) returned 1 [0096.257] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0096.264] SetEvent (hEvent=0x144) returned 1 [0096.265] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0096.265] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=16852) returned 1 [0096.265] CloseHandle (hObject=0x218) returned 1 [0096.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0096.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0096.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0096.266] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0096.266] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.266] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.266] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0096.266] ReadFile (in: hFile=0x218, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x41d4, lpOverlapped=0x0) returned 1 [0096.268] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x41e0, lpOverlapped=0x0) returned 1 [0096.269] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0096.270] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.270] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.270] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x41d4, lpOverlapped=0x0) returned 1 [0096.270] FlushFileBuffers (hFile=0x218) returned 1 [0096.282] FlushFileBuffers (hFile=0x19c) returned 1 [0096.284] CloseHandle (hObject=0x218) returned 1 [0096.284] CloseHandle (hObject=0x19c) returned 1 [0096.284] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0096.285] SetEvent (hEvent=0x144) returned 1 [0096.285] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.289] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=177720283) returned 1 [0096.289] CloseHandle (hObject=0x19c) returned 1 [0096.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0096.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0096.289] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.289] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.289] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.289] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.297] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.297] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.302] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.302] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.321] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.321] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0096.344] SetEndOfFile (hFile=0x19c) returned 1 [0096.344] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.344] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.346] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.347] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.347] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.348] FlushFileBuffers (hFile=0x19c) returned 1 [0096.470] CloseHandle (hObject=0x19c) returned 1 [0096.470] SetEvent (hEvent=0x144) returned 1 [0096.471] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.471] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1377656) returned 1 [0096.471] CloseHandle (hObject=0x19c) returned 1 [0096.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0096.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0096.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0096.471] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.471] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.471] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.471] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0096.472] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x110100, lpOverlapped=0x0) returned 1 [0096.505] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x110100, lpOverlapped=0x0) returned 1 [0096.529] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x40478, lpOverlapped=0x0) returned 1 [0096.532] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x40480, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x40480, lpOverlapped=0x0) returned 1 [0096.538] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0096.538] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.538] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.538] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x110102, lpOverlapped=0x0) returned 1 [0096.543] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x40476, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x40476, lpOverlapped=0x0) returned 1 [0096.544] FlushFileBuffers (hFile=0x19c) returned 1 [0096.625] FlushFileBuffers (hFile=0x1c4) returned 1 [0096.636] CloseHandle (hObject=0x19c) returned 1 [0096.636] CloseHandle (hObject=0x1c4) returned 1 [0096.636] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0096.648] SetEvent (hEvent=0x144) returned 1 [0096.648] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0096.648] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=31094) returned 1 [0096.648] CloseHandle (hObject=0x1c4) returned 1 [0096.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0096.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0096.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0096.649] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0096.649] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.649] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.649] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0096.654] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x7976, lpOverlapped=0x0) returned 1 [0096.656] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x7980, lpOverlapped=0x0) returned 1 [0096.657] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0096.657] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.658] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.658] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x7976, lpOverlapped=0x0) returned 1 [0096.658] FlushFileBuffers (hFile=0x1c4) returned 1 [0096.661] FlushFileBuffers (hFile=0x19c) returned 1 [0096.662] CloseHandle (hObject=0x1c4) returned 1 [0096.662] CloseHandle (hObject=0x19c) returned 1 [0096.662] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0096.663] SetEvent (hEvent=0x144) returned 1 [0096.664] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.664] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=4274) returned 1 [0096.665] CloseHandle (hObject=0x19c) returned 1 [0096.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0096.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0096.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0096.665] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.665] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.665] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.665] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0096.665] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x10b2, lpOverlapped=0x0) returned 1 [0096.667] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x10c0, lpOverlapped=0x0) returned 1 [0096.668] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0096.668] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.668] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.668] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x10b2, lpOverlapped=0x0) returned 1 [0096.668] FlushFileBuffers (hFile=0x19c) returned 1 [0096.670] FlushFileBuffers (hFile=0x1c4) returned 1 [0096.672] CloseHandle (hObject=0x19c) returned 1 [0096.672] CloseHandle (hObject=0x1c4) returned 1 [0096.672] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0096.673] SetEvent (hEvent=0x144) returned 1 [0096.673] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0096.673] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=174440) returned 1 [0096.673] CloseHandle (hObject=0x1c4) returned 1 [0096.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0096.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0096.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0096.673] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0096.674] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.674] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.674] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0096.674] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2a968, lpOverlapped=0x0) returned 1 [0096.680] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2a970, lpOverlapped=0x0) returned 1 [0096.684] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xe2, lpOverlapped=0x0) returned 1 [0096.684] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.684] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0096.684] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2a968, lpOverlapped=0x0) returned 1 [0096.685] FlushFileBuffers (hFile=0x1c4) returned 1 [0096.688] FlushFileBuffers (hFile=0x19c) returned 1 [0096.690] CloseHandle (hObject=0x1c4) returned 1 [0096.690] CloseHandle (hObject=0x19c) returned 1 [0096.690] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0096.692] SetEvent (hEvent=0x144) returned 1 [0096.692] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.692] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=7378792) returned 1 [0096.692] CloseHandle (hObject=0x19c) returned 1 [0096.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0096.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0096.693] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.693] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.693] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.693] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.698] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.698] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.700] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.700] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.721] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.721] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0096.788] SetEndOfFile (hFile=0x19c) returned 1 [0096.788] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.788] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.790] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.790] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.792] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.792] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.793] FlushFileBuffers (hFile=0x19c) returned 1 [0096.823] CloseHandle (hObject=0x19c) returned 1 [0096.823] SetEvent (hEvent=0x144) returned 1 [0096.824] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.826] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=36233052) returned 1 [0096.826] CloseHandle (hObject=0x19c) returned 1 [0096.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0096.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0096.832] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.832] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.832] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.832] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.837] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.837] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.842] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0096.842] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0096.856] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.856] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0096.881] SetEndOfFile (hFile=0x19c) returned 1 [0096.882] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.882] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.884] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.884] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.885] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0096.885] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0096.885] FlushFileBuffers (hFile=0x19c) returned 1 [0097.010] CloseHandle (hObject=0x19c) returned 1 [0097.010] SetEvent (hEvent=0x144) returned 1 [0097.011] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.013] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=715834) returned 1 [0097.013] CloseHandle (hObject=0x19c) returned 1 [0097.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0097.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0097.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.013] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.014] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.014] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.014] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0097.014] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0xaec3a, lpOverlapped=0x0) returned 1 [0097.028] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xaec40, lpOverlapped=0x0) returned 1 [0097.043] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x112, lpOverlapped=0x0) returned 1 [0097.043] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.043] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.043] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0xaec3a, lpOverlapped=0x0) returned 1 [0097.045] FlushFileBuffers (hFile=0x19c) returned 1 [0097.051] FlushFileBuffers (hFile=0x1c4) returned 1 [0097.053] CloseHandle (hObject=0x19c) returned 1 [0097.054] CloseHandle (hObject=0x1c4) returned 1 [0097.054] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0097.059] SetEvent (hEvent=0x144) returned 1 [0097.060] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0097.061] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=10798080) returned 1 [0097.061] CloseHandle (hObject=0x1c4) returned 1 [0097.061] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0097.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0097.061] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0097.061] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.061] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.061] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0097.066] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.066] ReadFile (in: hFile=0x1c4, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0097.071] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.071] ReadFile (in: hFile=0x1c4, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0097.086] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.086] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0097.109] SetEndOfFile (hFile=0x1c4) returned 1 [0097.109] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0097.109] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0097.111] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0097.111] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0097.113] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0097.113] WriteFile (in: hFile=0x1c4, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0097.114] FlushFileBuffers (hFile=0x1c4) returned 1 [0097.248] CloseHandle (hObject=0x1c4) returned 1 [0097.248] SetEvent (hEvent=0x144) returned 1 [0097.249] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0097.249] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1377656) returned 1 [0097.249] CloseHandle (hObject=0x1c4) returned 1 [0097.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0097.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0097.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.249] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0097.249] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.249] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.249] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0097.250] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x110100, lpOverlapped=0x0) returned 1 [0097.285] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x110100, lpOverlapped=0x0) returned 1 [0097.315] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x40478, lpOverlapped=0x0) returned 1 [0097.318] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x40480, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x40480, lpOverlapped=0x0) returned 1 [0097.323] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0097.323] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.323] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.323] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x110102, lpOverlapped=0x0) returned 1 [0097.329] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x40476, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x40476, lpOverlapped=0x0) returned 1 [0097.329] FlushFileBuffers (hFile=0x1c4) returned 1 [0097.419] FlushFileBuffers (hFile=0x19c) returned 1 [0097.437] CloseHandle (hObject=0x1c4) returned 1 [0097.437] CloseHandle (hObject=0x19c) returned 1 [0097.437] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0097.448] SetEvent (hEvent=0x144) returned 1 [0097.449] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.449] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=4274) returned 1 [0097.449] CloseHandle (hObject=0x19c) returned 1 [0097.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0097.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0097.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.450] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.450] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.450] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.450] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0097.450] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x10b2, lpOverlapped=0x0) returned 1 [0097.451] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x10c0, lpOverlapped=0x0) returned 1 [0097.452] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0097.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.453] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x10b2, lpOverlapped=0x0) returned 1 [0097.453] FlushFileBuffers (hFile=0x19c) returned 1 [0097.455] FlushFileBuffers (hFile=0x1c4) returned 1 [0097.459] CloseHandle (hObject=0x19c) returned 1 [0097.459] CloseHandle (hObject=0x1c4) returned 1 [0097.459] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0097.460] SetEvent (hEvent=0x144) returned 1 [0097.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0097.462] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=174440) returned 1 [0097.462] CloseHandle (hObject=0x1c4) returned 1 [0097.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0097.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0097.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.462] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0097.462] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.462] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.462] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0097.462] ReadFile (in: hFile=0x1c4, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2a968, lpOverlapped=0x0) returned 1 [0097.466] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2a970, lpOverlapped=0x0) returned 1 [0097.469] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xe2, lpOverlapped=0x0) returned 1 [0097.469] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.469] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.469] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2a968, lpOverlapped=0x0) returned 1 [0097.470] FlushFileBuffers (hFile=0x1c4) returned 1 [0097.481] FlushFileBuffers (hFile=0x19c) returned 1 [0097.483] CloseHandle (hObject=0x1c4) returned 1 [0097.483] CloseHandle (hObject=0x19c) returned 1 [0097.483] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0097.485] SetEvent (hEvent=0x144) returned 1 [0097.485] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.485] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=7378792) returned 1 [0097.485] CloseHandle (hObject=0x19c) returned 1 [0097.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0097.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0097.486] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.486] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.486] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.486] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0097.490] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.490] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0097.493] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0097.493] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0097.516] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.516] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0097.529] SetEndOfFile (hFile=0x19c) returned 1 [0097.529] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0097.529] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0097.530] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0097.530] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0097.538] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0097.538] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0097.539] FlushFileBuffers (hFile=0x19c) returned 1 [0097.632] CloseHandle (hObject=0x19c) returned 1 [0097.632] SetEvent (hEvent=0x144) returned 1 [0097.636] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.636] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1463568) returned 1 [0097.636] CloseHandle (hObject=0x19c) returned 1 [0097.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0097.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0097.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.636] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0097.636] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.636] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.636] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0097.637] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x110100, lpOverlapped=0x0) returned 1 [0097.670] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x110100, lpOverlapped=0x0) returned 1 [0097.722] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x55410, lpOverlapped=0x0) returned 1 [0097.726] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x55420, lpOverlapped=0x0) returned 1 [0097.733] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0097.733] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.733] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0097.733] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x110102, lpOverlapped=0x0) returned 1 [0097.762] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x5540e, lpOverlapped=0x0) returned 1 [0097.763] FlushFileBuffers (hFile=0x19c) returned 1 [0097.937] FlushFileBuffers (hFile=0x228) returned 1 [0097.986] CloseHandle (hObject=0x19c) returned 1 [0097.986] CloseHandle (hObject=0x228) returned 1 [0097.986] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0097.998] SetEvent (hEvent=0x144) returned 1 [0097.998] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0097.998] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=20577) returned 1 [0097.998] CloseHandle (hObject=0x228) returned 1 [0097.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0097.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0097.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.999] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0097.999] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.999] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.999] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0097.999] ReadFile (in: hFile=0x228, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x5061, lpOverlapped=0x0) returned 1 [0098.001] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x5070, lpOverlapped=0x0) returned 1 [0098.002] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.002] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.002] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.002] WriteFile (in: hFile=0x228, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x5061, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x5061, lpOverlapped=0x0) returned 1 [0098.003] FlushFileBuffers (hFile=0x228) returned 1 [0098.005] FlushFileBuffers (hFile=0x19c) returned 1 [0098.006] CloseHandle (hObject=0x228) returned 1 [0098.007] CloseHandle (hObject=0x19c) returned 1 [0098.007] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0098.008] SetEvent (hEvent=0x144) returned 1 [0098.008] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.009] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=195011319) returned 1 [0098.009] CloseHandle (hObject=0x19c) returned 1 [0098.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0098.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0098.009] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.010] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0098.010] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0098.010] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0098.015] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0098.016] ReadFile (in: hFile=0x19c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0098.020] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0098.020] ReadFile (in: hFile=0x19c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0098.032] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.032] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0112, lpOverlapped=0x0) returned 1 [0098.052] SetEndOfFile (hFile=0x19c) returned 1 [0098.052] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0098.052] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0098.054] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0098.054] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0098.056] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0098.056] WriteFile (in: hFile=0x19c, lpBuffer=0x2c9014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9014a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0098.057] FlushFileBuffers (hFile=0x19c) returned 1 [0098.347] CloseHandle (hObject=0x19c) returned 1 [0098.347] SetEvent (hEvent=0x144) returned 1 [0098.347] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.348] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=8723) returned 1 [0098.348] CloseHandle (hObject=0x19c) returned 1 [0098.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0098.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0098.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.348] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.348] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.348] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.348] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x194 [0098.348] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2213, lpOverlapped=0x0) returned 1 [0098.350] WriteFile (in: hFile=0x194, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2220, lpOverlapped=0x0) returned 1 [0098.351] WriteFile (in: hFile=0x194, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.351] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.351] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.351] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2213, lpOverlapped=0x0) returned 1 [0098.351] FlushFileBuffers (hFile=0x19c) returned 1 [0098.354] FlushFileBuffers (hFile=0x194) returned 1 [0098.356] CloseHandle (hObject=0x19c) returned 1 [0098.356] CloseHandle (hObject=0x194) returned 1 [0098.356] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0098.357] SetEvent (hEvent=0x144) returned 1 [0098.357] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\consider.exe" (normalized: "c:\\program files\\common files\\consider.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0098.358] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=75776) returned 1 [0098.358] CloseHandle (hObject=0x194) returned 1 [0098.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\consider.exe" (normalized: "c:\\program files\\common files\\consider.exe")) returned 0x20 [0098.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\consider.exe" (normalized: "c:\\program files\\common files\\consider.exe")) returned 0x20 [0098.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\consider.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\consider.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\consider.exe" (normalized: "c:\\program files\\common files\\consider.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0098.360] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=99136) returned 1 [0098.360] CloseHandle (hObject=0x194) returned 1 [0098.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0098.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0098.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0098.360] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.360] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0098.360] ReadFile (in: hFile=0x194, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x18340, lpOverlapped=0x0) returned 1 [0098.363] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x18350, lpOverlapped=0x0) returned 1 [0098.365] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.366] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.366] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.366] WriteFile (in: hFile=0x194, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x18340, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x18340, lpOverlapped=0x0) returned 1 [0098.366] FlushFileBuffers (hFile=0x194) returned 1 [0098.377] FlushFileBuffers (hFile=0x19c) returned 1 [0098.387] CloseHandle (hObject=0x194) returned 1 [0098.387] CloseHandle (hObject=0x19c) returned 1 [0098.387] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0098.389] SetEvent (hEvent=0x144) returned 1 [0098.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\images strict.exe" (normalized: "c:\\program files\\common files\\images strict.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.389] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=75776) returned 1 [0098.389] CloseHandle (hObject=0x19c) returned 1 [0098.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\images strict.exe" (normalized: "c:\\program files\\common files\\images strict.exe")) returned 0x20 [0098.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\images strict.exe" (normalized: "c:\\program files\\common files\\images strict.exe")) returned 0x20 [0098.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\images strict.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\images strict.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\images strict.exe" (normalized: "c:\\program files\\common files\\images strict.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.391] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1369952) returned 1 [0098.391] CloseHandle (hObject=0x19c) returned 1 [0098.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0098.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0098.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.392] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.392] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x194 [0098.392] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x110100, lpOverlapped=0x0) returned 1 [0098.424] WriteFile (in: hFile=0x194, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x110100, lpOverlapped=0x0) returned 1 [0098.450] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x3e660, lpOverlapped=0x0) returned 1 [0098.453] WriteFile (in: hFile=0x194, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x3e670, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x3e670, lpOverlapped=0x0) returned 1 [0098.458] WriteFile (in: hFile=0x194, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.459] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.459] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.459] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x110102, lpOverlapped=0x0) returned 1 [0098.464] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x3e65e, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x3e65e, lpOverlapped=0x0) returned 1 [0098.465] FlushFileBuffers (hFile=0x19c) returned 1 [0098.510] FlushFileBuffers (hFile=0x194) returned 1 [0098.567] CloseHandle (hObject=0x19c) returned 1 [0098.568] CloseHandle (hObject=0x194) returned 1 [0098.568] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0098.579] SetEvent (hEvent=0x144) returned 1 [0098.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.587] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=629664) returned 1 [0098.587] CloseHandle (hObject=0x19c) returned 1 [0098.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0098.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0098.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0098.587] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.587] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c4 [0098.588] ReadFile (in: hFile=0x19c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x99ba0, lpOverlapped=0x0) returned 1 [0098.599] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x99bb0, lpOverlapped=0x0) returned 1 [0098.629] WriteFile (in: hFile=0x1c4, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.630] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.630] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.630] WriteFile (in: hFile=0x19c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x99ba0, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x99ba0, lpOverlapped=0x0) returned 1 [0098.631] FlushFileBuffers (hFile=0x19c) returned 1 [0098.671] FlushFileBuffers (hFile=0x1c4) returned 1 [0098.747] CloseHandle (hObject=0x19c) returned 1 [0098.748] CloseHandle (hObject=0x1c4) returned 1 [0098.748] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0098.753] SetEvent (hEvent=0x144) returned 1 [0098.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.829] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2557) returned 1 [0098.829] CloseHandle (hObject=0x22c) returned 1 [0098.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0098.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0098.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.829] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.829] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x218 [0098.830] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x9fd, lpOverlapped=0x0) returned 1 [0098.831] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xa00, lpOverlapped=0x0) returned 1 [0098.832] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.832] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.832] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.832] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x9fd, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x9fd, lpOverlapped=0x0) returned 1 [0098.832] FlushFileBuffers (hFile=0x22c) returned 1 [0098.835] FlushFileBuffers (hFile=0x218) returned 1 [0098.836] CloseHandle (hObject=0x22c) returned 1 [0098.836] CloseHandle (hObject=0x218) returned 1 [0098.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0098.838] SetEvent (hEvent=0x144) returned 1 [0098.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0098.838] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=566) returned 1 [0098.838] CloseHandle (hObject=0x218) returned 1 [0098.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0098.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0098.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0098.838] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.839] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x22c [0098.839] ReadFile (in: hFile=0x218, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x236, lpOverlapped=0x0) returned 1 [0098.840] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x240, lpOverlapped=0x0) returned 1 [0098.841] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x102, lpOverlapped=0x0) returned 1 [0098.841] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.841] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.841] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x236, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x236, lpOverlapped=0x0) returned 1 [0098.841] FlushFileBuffers (hFile=0x218) returned 1 [0098.843] FlushFileBuffers (hFile=0x22c) returned 1 [0098.845] CloseHandle (hObject=0x218) returned 1 [0098.845] CloseHandle (hObject=0x22c) returned 1 [0098.845] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0098.846] SetEvent (hEvent=0x144) returned 1 [0098.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.846] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=176311) returned 1 [0098.847] CloseHandle (hObject=0x22c) returned 1 [0098.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0098.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0098.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.847] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.847] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x218 [0098.847] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x2b0b7, lpOverlapped=0x0) returned 1 [0098.851] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x2b0c0, lpOverlapped=0x0) returned 1 [0098.854] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0098.854] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.854] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0098.854] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x2b0b7, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x2b0b7, lpOverlapped=0x0) returned 1 [0098.855] FlushFileBuffers (hFile=0x22c) returned 1 [0099.080] FlushFileBuffers (hFile=0x218) returned 1 [0099.224] CloseHandle (hObject=0x22c) returned 1 [0099.225] CloseHandle (hObject=0x218) returned 1 [0099.233] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0099.248] SetEvent (hEvent=0x144) returned 1 [0099.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0099.279] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=1312656) returned 1 [0099.279] CloseHandle (hObject=0x218) returned 1 [0099.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0099.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0099.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0099.279] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.279] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x22c [0099.280] ReadFile (in: hFile=0x218, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x110100, lpOverlapped=0x0) returned 1 [0099.382] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x110100, lpOverlapped=0x0) returned 1 [0099.405] ReadFile (in: hFile=0x218, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x30690, lpOverlapped=0x0) returned 1 [0099.407] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x306a0, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x306a0, lpOverlapped=0x0) returned 1 [0099.412] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0099.412] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0099.412] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0099.412] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x110102, lpOverlapped=0x0) returned 1 [0099.417] WriteFile (in: hFile=0x218, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x3068e, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x3068e, lpOverlapped=0x0) returned 1 [0099.418] FlushFileBuffers (hFile=0x218) returned 1 [0099.620] FlushFileBuffers (hFile=0x22c) returned 1 [0099.630] CloseHandle (hObject=0x218) returned 1 [0099.630] CloseHandle (hObject=0x22c) returned 1 [0099.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0099.642] SetEvent (hEvent=0x144) returned 1 [0099.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.646] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=2124664) returned 1 [0099.646] CloseHandle (hObject=0x22c) returned 1 [0099.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0099.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0099.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0099.647] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0099.647] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0099.647] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2bd0058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0099.651] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0099.651] ReadFile (in: hFile=0x22c, lpBuffer=0x2c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c10058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0099.654] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x284fd50 | out: lpNewFilePointer=0x0) returned 1 [0099.654] ReadFile (in: hFile=0x22c, lpBuffer=0x2c50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x284fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c50058*, lpNumberOfBytesRead=0x284fd5c*=0x40000, lpOverlapped=0x0) returned 1 [0099.723] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.723] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x284feb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb8*=0xc0102, lpOverlapped=0x0) returned 1 [0099.735] SetEndOfFile (hFile=0x22c) returned 1 [0099.735] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0099.735] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0099.736] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0099.736] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0099.738] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fd58 | out: lpNewFilePointer=0x0) returned 1 [0099.738] WriteFile (in: hFile=0x22c, lpBuffer=0x2c9013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x284fd64, lpOverlapped=0x0 | out: lpBuffer=0x2c9013a*, lpNumberOfBytesWritten=0x284fd64*=0x40000, lpOverlapped=0x0) returned 1 [0099.740] FlushFileBuffers (hFile=0x22c) returned 1 [0100.964] CloseHandle (hObject=0x22c) returned 1 [0100.964] SetEvent (hEvent=0x144) returned 1 [0100.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.245] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x284ff00 | out: lpFileSize=0x284ff00*=320384) returned 1 [0101.245] CloseHandle (hObject=0x22c) returned 1 [0101.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0101.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0101.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0101.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0101.246] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.246] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x224 [0101.246] ReadFile (in: hFile=0x22c, lpBuffer=0x2bd0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x284fedc, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesRead=0x284fedc*=0x4e380, lpOverlapped=0x0) returned 1 [0101.253] WriteFile (in: hFile=0x224, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0x4e390, lpOverlapped=0x0) returned 1 [0101.260] WriteFile (in: hFile=0x224, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x284feb4, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284feb4*=0xf2, lpOverlapped=0x0) returned 1 [0101.260] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0101.260] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x284fc28 | out: lpNewFilePointer=0x0) returned 1 [0101.261] WriteFile (in: hFile=0x22c, lpBuffer=0x2bd0020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x284fc34, lpOverlapped=0x0 | out: lpBuffer=0x2bd0020*, lpNumberOfBytesWritten=0x284fc34*=0x4e380, lpOverlapped=0x0) returned 1 [0101.261] FlushFileBuffers (hFile=0x22c) returned 1 [0101.806] FlushFileBuffers (hFile=0x224) Thread: id = 14 os_tid = 0xb0c [0079.841] GetProcessHeap () returned 0x840000 [0079.841] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b44090 [0079.841] GetProcessHeap () returned 0x840000 [0079.841] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b54098 [0079.842] GetProcessHeap () returned 0x840000 [0079.842] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x904900 [0079.842] GetProcessHeap () returned 0x840000 [0079.842] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x110102) returned 0x2cf0020 [0079.842] GetProcessHeap () returned 0x840000 [0079.842] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0079.842] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0079.842] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0079.842] Wow64DisableWow64FsRedirection (in: OldValue=0x2a1fa20 | out: OldValue=0x2a1fa20*=0x0) returned 1 [0079.842] GetProcessHeap () returned 0x840000 [0079.842] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0079.842] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.842] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.842] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.843] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.844] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.845] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.846] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.847] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.848] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.849] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.850] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.851] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.852] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.853] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.854] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.855] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.856] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.857] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.858] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.859] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.860] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.861] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.862] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0087.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0087.854] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2a1f9c8 | out: lpFileSize=0x2a1f9c8*=483328) returned 1 [0087.854] CloseHandle (hObject=0x208) returned 1 [0087.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0087.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0087.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0087.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0087.855] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f990 | out: lpNewFilePointer=0x0) returned 1 [0087.855] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f990 | out: lpNewFilePointer=0x0) returned 1 [0087.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x214 [0087.855] ReadFile (in: hFile=0x208, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x76000, lpOverlapped=0x0) returned 1 [0087.879] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x76010, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x76010, lpOverlapped=0x0) returned 1 [0087.886] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0xf2, lpOverlapped=0x0) returned 1 [0087.887] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f6f0 | out: lpNewFilePointer=0x0) returned 1 [0087.887] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f6f0 | out: lpNewFilePointer=0x0) returned 1 [0087.887] WriteFile (in: hFile=0x208, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x76000, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x76000, lpOverlapped=0x0) returned 1 [0087.888] FlushFileBuffers (hFile=0x208) returned 1 [0088.220] FlushFileBuffers (hFile=0x214) returned 1 [0088.266] CloseHandle (hObject=0x208) returned 1 [0088.271] CloseHandle (hObject=0x214) returned 1 [0088.281] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 1 [0088.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0088.285] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a1f9c8 | out: lpFileSize=0x2a1f9c8*=9404416) returned 1 [0088.285] CloseHandle (hObject=0x214) returned 1 [0088.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 0x20 [0088.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 0x20 [0088.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0088.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0088.286] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f990 | out: lpNewFilePointer=0x0) returned 1 [0088.286] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f990 | out: lpNewFilePointer=0x0) returned 1 [0088.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x218 [0088.286] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.354] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.382] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.459] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.480] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.514] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.549] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.584] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.637] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.655] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.686] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.705] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.794] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.907] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0088.930] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x110100, lpOverlapped=0x0) returned 1 [0088.948] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x110100, lpOverlapped=0x0) returned 1 [0089.067] ReadFile (in: hFile=0x214, lpBuffer=0x2cf0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2a1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesRead=0x2a1f9a4*=0x77800, lpOverlapped=0x0) returned 1 [0089.072] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x77810, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0x77810, lpOverlapped=0x0) returned 1 [0089.081] WriteFile (in: hFile=0x218, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2a1f97c, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f97c*=0xf2, lpOverlapped=0x0) returned 1 [0089.082] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f6f0 | out: lpNewFilePointer=0x0) returned 1 [0089.082] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a1f6f0 | out: lpNewFilePointer=0x0) returned 1 [0089.082] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.203] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.225] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.239] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.408] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.421] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.435] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.589] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x110102, lpOverlapped=0x0) returned 1 [0089.602] WriteFile (in: hFile=0x214, lpBuffer=0x2cf0020*, nNumberOfBytesToWrite=0x777f0, lpNumberOfBytesWritten=0x2a1f6fc, lpOverlapped=0x0 | out: lpBuffer=0x2cf0020*, lpNumberOfBytesWritten=0x2a1f6fc*=0x777f0, lpOverlapped=0x0) returned 1 [0089.603] FlushFileBuffers (hFile=0x214) returned 1 [0091.466] FlushFileBuffers (hFile=0x218) returned 1 [0091.784] CloseHandle (hObject=0x214) returned 1 [0092.437] CloseHandle (hObject=0x218) returned 1 [0092.438] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 1 [0092.447] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0099.835] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) Thread: id = 15 os_tid = 0xb10 [0079.874] GetProcessHeap () returned 0x840000 [0079.874] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b01068 [0079.874] GetProcessHeap () returned 0x840000 [0079.874] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b642b0 [0079.874] GetProcessHeap () returned 0x840000 [0079.874] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x901038 [0079.874] GetProcessHeap () returned 0x840000 [0079.875] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x110102) returned 0x2e10020 [0079.875] GetProcessHeap () returned 0x840000 [0079.875] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0079.875] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0079.875] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0079.875] Wow64DisableWow64FsRedirection (in: OldValue=0x280fb48 | out: OldValue=0x280fb48*=0x0) returned 1 [0079.875] GetProcessHeap () returned 0x840000 [0079.875] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0079.875] SetEvent (hEvent=0x144) returned 1 [0079.875] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0079.876] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=0) returned 1 [0079.876] CloseHandle (hObject=0x1a8) returned 1 [0079.876] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0079.876] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=0) returned 1 [0079.877] CloseHandle (hObject=0x1a8) returned 1 [0079.877] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0079.877] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=65536) returned 1 [0079.877] CloseHandle (hObject=0x1a8) returned 1 [0079.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0079.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0079.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.877] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0079.877] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0079.877] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0079.877] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1b4 [0079.878] ReadFile (in: hFile=0x1a8, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x10000, lpOverlapped=0x0) returned 1 [0079.938] WriteFile (in: hFile=0x1b4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x10010, lpOverlapped=0x0) returned 1 [0079.939] WriteFile (in: hFile=0x1b4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0079.940] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0079.940] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0079.940] WriteFile (in: hFile=0x1a8, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x10000, lpOverlapped=0x0) returned 1 [0079.940] FlushFileBuffers (hFile=0x1a8) returned 1 [0080.544] FlushFileBuffers (hFile=0x1b4) returned 1 [0080.746] CloseHandle (hObject=0x1a8) returned 1 [0080.747] CloseHandle (hObject=0x1b4) returned 1 [0080.748] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0080.750] SetEvent (hEvent=0x144) returned 1 [0080.751] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0080.751] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2506240) returned 1 [0080.751] CloseHandle (hObject=0x1a8) returned 1 [0080.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0080.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0080.752] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0080.752] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0080.752] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0080.752] ReadFile (in: hFile=0x1a8, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0080.756] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0080.756] ReadFile (in: hFile=0x1a8, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0080.765] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0080.765] ReadFile (in: hFile=0x1a8, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0080.778] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0080.778] WriteFile (in: hFile=0x1a8, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0080.889] SetEndOfFile (hFile=0x1a8) returned 1 [0080.889] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0080.889] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0080.891] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0080.891] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0080.895] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0080.895] WriteFile (in: hFile=0x1a8, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0080.897] FlushFileBuffers (hFile=0x1a8) returned 1 [0082.373] CloseHandle (hObject=0x1a8) returned 1 [0082.626] SetEvent (hEvent=0x144) returned 1 [0082.627] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0082.627] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1450) returned 1 [0082.627] CloseHandle (hObject=0x1a8) returned 1 [0082.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0082.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0082.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.627] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0082.628] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0082.628] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0082.628] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1fc [0082.628] ReadFile (in: hFile=0x1a8, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x5aa, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x1fc, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x5b0, lpOverlapped=0x0) returned 1 [0082.630] WriteFile (in: hFile=0x1fc, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x102, lpOverlapped=0x0) returned 1 [0082.631] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0082.631] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0082.631] WriteFile (in: hFile=0x1a8, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x5aa, lpOverlapped=0x0) returned 1 [0082.631] FlushFileBuffers (hFile=0x1a8) returned 1 [0083.078] FlushFileBuffers (hFile=0x1fc) returned 1 [0083.259] CloseHandle (hObject=0x1a8) returned 1 [0083.260] CloseHandle (hObject=0x1fc) returned 1 [0083.261] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0083.262] SetEvent (hEvent=0x144) returned 1 [0083.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0083.314] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=70361744) returned 1 [0083.314] CloseHandle (hObject=0x208) returned 1 [0083.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0083.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0083.315] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0083.315] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0083.315] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0083.315] ReadFile (in: hFile=0x208, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0083.321] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0083.321] ReadFile (in: hFile=0x208, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0083.323] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0083.323] ReadFile (in: hFile=0x208, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0083.337] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0083.337] WriteFile (in: hFile=0x208, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0083.350] SetEndOfFile (hFile=0x208) returned 1 [0083.350] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0083.350] WriteFile (in: hFile=0x208, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0083.462] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0083.462] WriteFile (in: hFile=0x208, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0083.463] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0083.463] WriteFile (in: hFile=0x208, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0083.464] FlushFileBuffers (hFile=0x208) returned 1 [0084.399] CloseHandle (hObject=0x208) returned 1 [0085.398] SetEvent (hEvent=0x144) returned 1 [0085.399] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0085.400] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=9958388) returned 1 [0085.400] CloseHandle (hObject=0x208) returned 1 [0085.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0085.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0085.400] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0085.400] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0085.400] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0085.400] ReadFile (in: hFile=0x208, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0085.404] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0085.404] ReadFile (in: hFile=0x208, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0085.411] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0085.411] ReadFile (in: hFile=0x208, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0085.428] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0085.428] WriteFile (in: hFile=0x208, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0085.540] SetEndOfFile (hFile=0x208) returned 1 [0085.541] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0085.541] WriteFile (in: hFile=0x208, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0085.543] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0085.543] WriteFile (in: hFile=0x208, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0085.545] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0085.545] WriteFile (in: hFile=0x208, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0085.546] FlushFileBuffers (hFile=0x208) returned 1 [0086.551] CloseHandle (hObject=0x208) returned 1 [0087.735] SetEvent (hEvent=0x144) returned 1 [0087.736] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0087.736] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2865664) returned 1 [0087.736] CloseHandle (hObject=0x1c4) returned 1 [0087.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0087.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0087.737] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0087.737] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0087.737] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0087.737] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0087.741] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0087.741] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0087.749] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0087.749] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0087.761] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0087.761] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0087.778] SetEndOfFile (hFile=0x1c4) returned 1 [0087.778] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0087.778] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0087.781] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0087.781] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0087.931] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0087.931] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0087.932] FlushFileBuffers (hFile=0x1c4) returned 1 [0088.726] CloseHandle (hObject=0x1c4) returned 1 [0088.837] SetEvent (hEvent=0x144) returned 1 [0088.837] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0088.838] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2522624) returned 1 [0088.838] CloseHandle (hObject=0x1c4) returned 1 [0088.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0088.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0088.845] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0088.845] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0088.845] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0088.845] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0088.849] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0088.849] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0088.858] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0088.858] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0088.969] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0088.969] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0088.988] SetEndOfFile (hFile=0x1c4) returned 1 [0088.988] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0088.988] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0088.990] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0088.990] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0088.994] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0088.994] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0088.996] FlushFileBuffers (hFile=0x1c4) returned 1 [0090.137] CloseHandle (hObject=0x1c4) returned 1 [0090.262] SetEvent (hEvent=0x144) returned 1 [0090.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0090.263] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=875520) returned 1 [0090.263] CloseHandle (hObject=0x1c4) returned 1 [0090.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0090.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0090.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0090.263] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0090.263] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0090.263] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0090.279] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xd5c00, lpOverlapped=0x0) returned 1 [0090.298] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xd5c10, lpOverlapped=0x0) returned 1 [0090.316] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0090.317] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0090.317] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0090.317] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xd5c00, lpOverlapped=0x0) returned 1 [0090.319] FlushFileBuffers (hFile=0x1c4) returned 1 [0090.762] FlushFileBuffers (hFile=0x228) returned 1 [0090.902] CloseHandle (hObject=0x1c4) returned 1 [0090.907] CloseHandle (hObject=0x228) returned 1 [0090.920] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0090.928] SetEvent (hEvent=0x144) returned 1 [0090.928] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0090.928] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1347) returned 1 [0090.928] CloseHandle (hObject=0x228) returned 1 [0090.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0090.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0090.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.928] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0090.928] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0090.929] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0090.929] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0090.929] ReadFile (in: hFile=0x228, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x543, lpOverlapped=0x0) returned 1 [0091.015] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x550, lpOverlapped=0x0) returned 1 [0091.016] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0091.017] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0091.017] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0091.017] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x543, lpOverlapped=0x0) returned 1 [0091.017] FlushFileBuffers (hFile=0x228) returned 1 [0091.060] FlushFileBuffers (hFile=0x1c4) returned 1 [0091.107] CloseHandle (hObject=0x228) returned 1 [0091.108] CloseHandle (hObject=0x1c4) returned 1 [0091.109] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0091.110] SetEvent (hEvent=0x144) returned 1 [0091.110] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0091.114] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=13642474) returned 1 [0091.114] CloseHandle (hObject=0x1c4) returned 1 [0091.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0091.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0091.115] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0091.115] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0091.115] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0091.115] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0091.119] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0091.120] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0091.126] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0091.126] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0091.142] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0091.142] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0091.267] SetEndOfFile (hFile=0x1c4) returned 1 [0091.267] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0091.267] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0091.268] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0091.268] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0091.269] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0091.269] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0091.270] FlushFileBuffers (hFile=0x1c4) returned 1 [0091.572] CloseHandle (hObject=0x1c4) returned 1 [0092.461] SetEvent (hEvent=0x144) returned 1 [0092.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.479] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=885760) returned 1 [0092.479] CloseHandle (hObject=0x218) returned 1 [0092.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0092.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0092.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.479] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.480] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.480] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.480] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0092.498] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xd8400, lpOverlapped=0x0) returned 1 [0092.518] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xd8410, lpOverlapped=0x0) returned 1 [0092.538] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0092.538] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.538] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.538] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xd8400, lpOverlapped=0x0) returned 1 [0092.574] FlushFileBuffers (hFile=0x218) returned 1 [0092.677] FlushFileBuffers (hFile=0x1c4) returned 1 [0092.693] CloseHandle (hObject=0x218) returned 1 [0092.693] CloseHandle (hObject=0x1c4) returned 1 [0092.694] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0092.701] SetEvent (hEvent=0x144) returned 1 [0092.702] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0092.702] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=811) returned 1 [0092.702] CloseHandle (hObject=0x1c4) returned 1 [0092.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0092.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0092.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.702] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0092.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.703] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0092.703] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x32b, lpOverlapped=0x0) returned 1 [0092.704] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x330, lpOverlapped=0x0) returned 1 [0092.705] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0092.705] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.706] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.706] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x32b, lpOverlapped=0x0) returned 1 [0092.706] FlushFileBuffers (hFile=0x1c4) returned 1 [0092.711] FlushFileBuffers (hFile=0x218) returned 1 [0092.712] CloseHandle (hObject=0x1c4) returned 1 [0092.712] CloseHandle (hObject=0x218) returned 1 [0092.712] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0092.715] SetEvent (hEvent=0x144) returned 1 [0092.715] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.715] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=5884) returned 1 [0092.715] CloseHandle (hObject=0x218) returned 1 [0092.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0092.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0092.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.715] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.715] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.715] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.716] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0092.716] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x16fc, lpOverlapped=0x0) returned 1 [0092.719] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x1700, lpOverlapped=0x0) returned 1 [0092.720] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0092.720] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.720] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.720] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x16fc, lpOverlapped=0x0) returned 1 [0092.720] FlushFileBuffers (hFile=0x218) returned 1 [0092.723] FlushFileBuffers (hFile=0x1c4) returned 1 [0092.726] CloseHandle (hObject=0x218) returned 1 [0092.726] CloseHandle (hObject=0x1c4) returned 1 [0092.726] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0092.727] SetEvent (hEvent=0x144) returned 1 [0092.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0092.728] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=873984) returned 1 [0092.728] CloseHandle (hObject=0x1c4) returned 1 [0092.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0092.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0092.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.728] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0092.728] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.728] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.728] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0092.729] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xd5600, lpOverlapped=0x0) returned 1 [0092.744] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xd5610, lpOverlapped=0x0) returned 1 [0092.760] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0092.760] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.760] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.760] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xd5600, lpOverlapped=0x0) returned 1 [0092.762] FlushFileBuffers (hFile=0x1c4) returned 1 [0092.893] FlushFileBuffers (hFile=0x218) returned 1 [0092.980] CloseHandle (hObject=0x1c4) returned 1 [0092.981] CloseHandle (hObject=0x218) returned 1 [0092.981] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0092.989] SetEvent (hEvent=0x144) returned 1 [0092.990] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.990] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2362) returned 1 [0092.990] CloseHandle (hObject=0x218) returned 1 [0092.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0092.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0092.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.990] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.990] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.990] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0092.990] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0092.991] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x93a, lpOverlapped=0x0) returned 1 [0092.992] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x940, lpOverlapped=0x0) returned 1 [0092.993] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0092.994] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.994] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0092.994] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x93a, lpOverlapped=0x0) returned 1 [0092.994] FlushFileBuffers (hFile=0x218) returned 1 [0093.023] FlushFileBuffers (hFile=0x1c4) returned 1 [0093.025] CloseHandle (hObject=0x218) returned 1 [0093.025] CloseHandle (hObject=0x1c4) returned 1 [0093.025] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0093.026] SetEvent (hEvent=0x144) returned 1 [0093.026] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.027] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=18874884) returned 1 [0093.027] CloseHandle (hObject=0x1c4) returned 1 [0093.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0093.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.029] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.029] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.029] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.029] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.032] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.033] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.040] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.040] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.054] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0093.054] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0093.068] SetEndOfFile (hFile=0x1c4) returned 1 [0093.068] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.068] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.070] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.070] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.119] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.119] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.120] FlushFileBuffers (hFile=0x1c4) returned 1 [0093.211] CloseHandle (hObject=0x1c4) returned 1 [0093.211] SetEvent (hEvent=0x144) returned 1 [0093.212] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.212] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=3124224) returned 1 [0093.212] CloseHandle (hObject=0x1c4) returned 1 [0093.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0093.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.215] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.215] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.215] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.215] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.220] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.220] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.228] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.228] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.241] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0093.241] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0093.261] SetEndOfFile (hFile=0x1c4) returned 1 [0093.262] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.262] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.264] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.264] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.266] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.266] WriteFile (in: hFile=0x1c4, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.268] FlushFileBuffers (hFile=0x1c4) returned 1 [0093.373] CloseHandle (hObject=0x1c4) returned 1 [0093.373] SetEvent (hEvent=0x144) returned 1 [0093.374] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.374] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1231) returned 1 [0093.374] CloseHandle (hObject=0x1c4) returned 1 [0093.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0093.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0093.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.374] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.374] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0093.374] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0093.375] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0093.375] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x4cf, lpOverlapped=0x0) returned 1 [0093.376] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x4d0, lpOverlapped=0x0) returned 1 [0093.377] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0093.377] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0093.377] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0093.377] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x4cf, lpOverlapped=0x0) returned 1 [0093.377] FlushFileBuffers (hFile=0x1c4) returned 1 [0093.556] FlushFileBuffers (hFile=0x1ac) returned 1 [0093.627] CloseHandle (hObject=0x1c4) returned 1 [0093.628] CloseHandle (hObject=0x1ac) returned 1 [0093.628] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0093.629] SetEvent (hEvent=0x144) returned 1 [0093.629] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0093.630] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2797568) returned 1 [0093.630] CloseHandle (hObject=0x1ac) returned 1 [0093.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0093.630] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.630] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0093.630] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.630] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.630] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.635] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.635] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.643] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.644] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.656] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0093.656] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0093.702] SetEndOfFile (hFile=0x1ac) returned 1 [0093.703] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.703] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.705] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.705] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.708] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.708] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.709] FlushFileBuffers (hFile=0x1ac) returned 1 [0093.812] CloseHandle (hObject=0x1ac) returned 1 [0093.812] SetEvent (hEvent=0x144) returned 1 [0093.812] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0093.813] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1606) returned 1 [0093.813] CloseHandle (hObject=0x1ac) returned 1 [0093.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0093.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0093.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.813] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0093.813] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0093.813] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0093.813] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0093.814] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x646, lpOverlapped=0x0) returned 1 [0093.821] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x650, lpOverlapped=0x0) returned 1 [0093.822] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0093.822] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0093.822] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0093.822] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x646, lpOverlapped=0x0) returned 1 [0093.822] FlushFileBuffers (hFile=0x1ac) returned 1 [0093.831] FlushFileBuffers (hFile=0x19c) returned 1 [0093.839] CloseHandle (hObject=0x1ac) returned 1 [0093.839] CloseHandle (hObject=0x19c) returned 1 [0093.839] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0093.840] SetEvent (hEvent=0x144) returned 1 [0093.840] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.840] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=17456632) returned 1 [0093.841] CloseHandle (hObject=0x19c) returned 1 [0093.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0093.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.841] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.841] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.841] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.841] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.846] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.846] ReadFile (in: hFile=0x19c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.849] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.849] ReadFile (in: hFile=0x19c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.861] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0093.861] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0093.875] SetEndOfFile (hFile=0x19c) returned 1 [0093.876] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.876] WriteFile (in: hFile=0x19c, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.878] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.878] WriteFile (in: hFile=0x19c, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.878] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0093.878] WriteFile (in: hFile=0x19c, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0093.879] FlushFileBuffers (hFile=0x19c) returned 1 [0093.955] CloseHandle (hObject=0x19c) returned 1 [0093.955] SetEvent (hEvent=0x144) returned 1 [0093.955] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.956] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1988) returned 1 [0093.956] CloseHandle (hObject=0x19c) returned 1 [0093.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0093.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0093.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.957] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0093.957] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0093.957] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0093.957] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0093.958] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x7c4, lpOverlapped=0x0) returned 1 [0093.959] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x7d0, lpOverlapped=0x0) returned 1 [0093.960] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0093.961] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0093.961] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0093.961] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x7c4, lpOverlapped=0x0) returned 1 [0093.961] FlushFileBuffers (hFile=0x19c) returned 1 [0093.963] FlushFileBuffers (hFile=0x1ac) returned 1 [0093.965] CloseHandle (hObject=0x19c) returned 1 [0093.965] CloseHandle (hObject=0x1ac) returned 1 [0093.965] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0093.966] SetEvent (hEvent=0x144) returned 1 [0093.966] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.969] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2511872) returned 1 [0093.969] CloseHandle (hObject=0x22c) returned 1 [0093.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0093.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0093.970] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0093.970] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.970] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.970] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.974] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.974] ReadFile (in: hFile=0x22c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.982] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0093.982] ReadFile (in: hFile=0x22c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0093.995] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0093.995] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0094.044] SetEndOfFile (hFile=0x22c) returned 1 [0094.044] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.044] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.046] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.046] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.050] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.050] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.051] FlushFileBuffers (hFile=0x22c) returned 1 [0094.098] CloseHandle (hObject=0x22c) returned 1 [0094.146] SetEvent (hEvent=0x144) returned 1 [0094.147] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.147] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1872) returned 1 [0094.147] CloseHandle (hObject=0x228) returned 1 [0094.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0094.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0094.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.151] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.151] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.152] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.152] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0094.152] ReadFile (in: hFile=0x228, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x750, lpOverlapped=0x0) returned 1 [0094.156] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x760, lpOverlapped=0x0) returned 1 [0094.156] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.157] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.157] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.157] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x750, lpOverlapped=0x0) returned 1 [0094.157] FlushFileBuffers (hFile=0x228) returned 1 [0094.160] FlushFileBuffers (hFile=0x22c) returned 1 [0094.162] CloseHandle (hObject=0x228) returned 1 [0094.162] CloseHandle (hObject=0x22c) returned 1 [0094.162] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0094.163] SetEvent (hEvent=0x144) returned 1 [0094.163] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.165] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=4095519) returned 1 [0094.165] CloseHandle (hObject=0x22c) returned 1 [0094.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0094.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0094.166] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0094.166] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.166] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.166] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0094.168] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.170] ReadFile (in: hFile=0x22c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0094.173] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.173] ReadFile (in: hFile=0x22c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0094.185] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0094.185] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0094.206] SetEndOfFile (hFile=0x22c) returned 1 [0094.207] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.207] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.339] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.339] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.341] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.341] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.343] FlushFileBuffers (hFile=0x22c) returned 1 [0094.533] CloseHandle (hObject=0x22c) returned 1 [0094.533] SetEvent (hEvent=0x144) returned 1 [0094.535] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.535] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=913) returned 1 [0094.536] CloseHandle (hObject=0x228) returned 1 [0094.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0094.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0094.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.536] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.536] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.536] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0094.536] ReadFile (in: hFile=0x228, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x391, lpOverlapped=0x0) returned 1 [0094.538] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x3a0, lpOverlapped=0x0) returned 1 [0094.539] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.539] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.539] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.539] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x391, lpOverlapped=0x0) returned 1 [0094.539] FlushFileBuffers (hFile=0x228) returned 1 [0094.542] FlushFileBuffers (hFile=0x218) returned 1 [0094.544] CloseHandle (hObject=0x228) returned 1 [0094.544] CloseHandle (hObject=0x218) returned 1 [0094.544] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0094.545] SetEvent (hEvent=0x144) returned 1 [0094.545] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0094.545] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1452) returned 1 [0094.545] CloseHandle (hObject=0x218) returned 1 [0094.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0094.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0094.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.545] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0094.546] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.546] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.546] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0094.546] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x5ac, lpOverlapped=0x0) returned 1 [0094.547] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x5b0, lpOverlapped=0x0) returned 1 [0094.548] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.548] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.548] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.548] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x5ac, lpOverlapped=0x0) returned 1 [0094.549] FlushFileBuffers (hFile=0x218) returned 1 [0094.551] FlushFileBuffers (hFile=0x228) returned 1 [0094.552] CloseHandle (hObject=0x218) returned 1 [0094.552] CloseHandle (hObject=0x228) returned 1 [0094.553] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0094.553] SetEvent (hEvent=0x144) returned 1 [0094.554] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.555] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=107912) returned 1 [0094.555] CloseHandle (hObject=0x228) returned 1 [0094.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0094.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0094.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.555] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.555] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.555] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.555] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0094.556] ReadFile (in: hFile=0x228, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x1a588, lpOverlapped=0x0) returned 1 [0094.560] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x1a590, lpOverlapped=0x0) returned 1 [0094.562] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.563] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.563] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.563] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1a588, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x1a588, lpOverlapped=0x0) returned 1 [0094.563] FlushFileBuffers (hFile=0x228) returned 1 [0094.572] FlushFileBuffers (hFile=0x218) returned 1 [0094.574] CloseHandle (hObject=0x228) returned 1 [0094.574] CloseHandle (hObject=0x218) returned 1 [0094.574] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0094.576] SetEvent (hEvent=0x144) returned 1 [0094.576] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0094.577] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=596341) returned 1 [0094.577] CloseHandle (hObject=0x218) returned 1 [0094.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0094.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0094.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.577] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0094.577] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.577] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.577] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0094.577] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x91975, lpOverlapped=0x0) returned 1 [0094.589] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x91980, lpOverlapped=0x0) returned 1 [0094.599] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.599] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.599] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.599] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x91975, lpOverlapped=0x0) returned 1 [0094.600] FlushFileBuffers (hFile=0x218) returned 1 [0094.645] FlushFileBuffers (hFile=0x228) returned 1 [0094.647] CloseHandle (hObject=0x218) returned 1 [0094.647] CloseHandle (hObject=0x228) returned 1 [0094.647] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0094.653] SetEvent (hEvent=0x144) returned 1 [0094.653] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.654] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=838536) returned 1 [0094.654] CloseHandle (hObject=0x228) returned 1 [0094.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0094.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0094.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.654] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0094.654] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.654] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.654] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0094.655] ReadFile (in: hFile=0x228, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xccb88, lpOverlapped=0x0) returned 1 [0094.669] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xccb90, lpOverlapped=0x0) returned 1 [0094.683] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.683] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.683] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.683] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xccb88, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xccb88, lpOverlapped=0x0) returned 1 [0094.685] FlushFileBuffers (hFile=0x228) returned 1 [0094.708] FlushFileBuffers (hFile=0x218) returned 1 [0094.711] CloseHandle (hObject=0x228) returned 1 [0094.711] CloseHandle (hObject=0x218) returned 1 [0094.711] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0094.718] SetEvent (hEvent=0x144) returned 1 [0094.719] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.719] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=526176) returned 1 [0094.719] CloseHandle (hObject=0x19c) returned 1 [0094.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0094.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0094.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.719] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.719] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.719] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.720] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x218 [0094.720] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x80760, lpOverlapped=0x0) returned 1 [0094.730] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x80770, lpOverlapped=0x0) returned 1 [0094.738] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.739] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.739] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.739] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x80760, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x80760, lpOverlapped=0x0) returned 1 [0094.740] FlushFileBuffers (hFile=0x19c) returned 1 [0094.755] FlushFileBuffers (hFile=0x218) returned 1 [0094.757] CloseHandle (hObject=0x19c) returned 1 [0094.758] CloseHandle (hObject=0x218) returned 1 [0094.758] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0094.763] SetEvent (hEvent=0x144) returned 1 [0094.763] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0094.763] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=519584) returned 1 [0094.763] CloseHandle (hObject=0x218) returned 1 [0094.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0094.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0094.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0094.763] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0094.763] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.763] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0094.764] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0094.764] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x7eda0, lpOverlapped=0x0) returned 1 [0094.774] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x7edb0, lpOverlapped=0x0) returned 1 [0094.783] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0094.783] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.783] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0094.783] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x7eda0, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x7eda0, lpOverlapped=0x0) returned 1 [0094.784] FlushFileBuffers (hFile=0x218) returned 1 [0094.854] FlushFileBuffers (hFile=0x19c) returned 1 [0094.921] CloseHandle (hObject=0x218) returned 1 [0094.921] CloseHandle (hObject=0x19c) returned 1 [0094.922] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0094.926] SetEvent (hEvent=0x144) returned 1 [0094.926] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.927] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=3702272) returned 1 [0094.927] CloseHandle (hObject=0x19c) returned 1 [0094.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0094.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0094.927] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.927] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.928] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.928] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0094.932] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.932] ReadFile (in: hFile=0x19c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0094.938] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0094.938] ReadFile (in: hFile=0x19c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0094.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0094.951] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0094.973] SetEndOfFile (hFile=0x19c) returned 1 [0094.973] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.973] WriteFile (in: hFile=0x19c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.975] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.975] WriteFile (in: hFile=0x19c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.977] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0094.977] WriteFile (in: hFile=0x19c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0094.979] FlushFileBuffers (hFile=0x19c) returned 1 [0095.066] CloseHandle (hObject=0x19c) returned 1 [0095.069] SetEvent (hEvent=0x144) returned 1 [0095.077] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.077] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=868864) returned 1 [0095.077] CloseHandle (hObject=0x19c) returned 1 [0095.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0095.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0095.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.077] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.077] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.077] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.078] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0095.078] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xd4200, lpOverlapped=0x0) returned 1 [0095.094] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xd4210, lpOverlapped=0x0) returned 1 [0095.109] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x102, lpOverlapped=0x0) returned 1 [0095.110] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.110] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.110] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xd4200, lpOverlapped=0x0) returned 1 [0095.112] FlushFileBuffers (hFile=0x19c) returned 1 [0095.170] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.187] CloseHandle (hObject=0x19c) returned 1 [0095.187] CloseHandle (hObject=0x1ac) returned 1 [0095.187] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0095.195] SetEvent (hEvent=0x144) returned 1 [0095.195] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.195] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=67190) returned 1 [0095.195] CloseHandle (hObject=0x1ac) returned 1 [0095.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0095.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0095.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.196] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.196] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x19c [0095.196] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x10676, lpOverlapped=0x0) returned 1 [0095.199] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x10680, lpOverlapped=0x0) returned 1 [0095.200] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0095.201] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.201] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.201] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x10676, lpOverlapped=0x0) returned 1 [0095.201] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.286] FlushFileBuffers (hFile=0x19c) returned 1 [0095.295] CloseHandle (hObject=0x1ac) returned 1 [0095.295] CloseHandle (hObject=0x19c) returned 1 [0095.295] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0095.297] SetEvent (hEvent=0x144) returned 1 [0095.297] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.297] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1349) returned 1 [0095.297] CloseHandle (hObject=0x19c) returned 1 [0095.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0095.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0095.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.298] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0095.298] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.298] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.298] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0095.298] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x545, lpOverlapped=0x0) returned 1 [0095.300] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x550, lpOverlapped=0x0) returned 1 [0095.300] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0095.301] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.301] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.301] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x545, lpOverlapped=0x0) returned 1 [0095.301] FlushFileBuffers (hFile=0x19c) returned 1 [0095.318] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.319] CloseHandle (hObject=0x19c) returned 1 [0095.320] CloseHandle (hObject=0x1ac) returned 1 [0095.320] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0095.321] SetEvent (hEvent=0x144) returned 1 [0095.321] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.321] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=28016276) returned 1 [0095.321] CloseHandle (hObject=0x1ac) returned 1 [0095.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0095.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0095.322] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.322] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.322] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.322] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0095.325] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.327] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0095.331] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.331] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0095.343] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0095.343] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0095.359] SetEndOfFile (hFile=0x1ac) returned 1 [0095.359] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0095.359] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0095.361] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0095.361] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0095.386] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0095.386] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0095.387] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.581] CloseHandle (hObject=0x1ac) returned 1 [0095.584] SetEvent (hEvent=0x144) returned 1 [0095.628] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.629] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=2624) returned 1 [0095.629] CloseHandle (hObject=0x22c) returned 1 [0095.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0095.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0095.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.629] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.629] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.629] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.629] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0095.630] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xa40, lpOverlapped=0x0) returned 1 [0095.631] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xa50, lpOverlapped=0x0) returned 1 [0095.632] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0095.632] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.632] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.632] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xa40, lpOverlapped=0x0) returned 1 [0095.632] FlushFileBuffers (hFile=0x22c) returned 1 [0095.650] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.651] CloseHandle (hObject=0x22c) returned 1 [0095.652] CloseHandle (hObject=0x1ac) returned 1 [0095.652] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0095.653] SetEvent (hEvent=0x144) returned 1 [0095.653] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.653] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=4274) returned 1 [0095.653] CloseHandle (hObject=0x1ac) returned 1 [0095.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0095.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0095.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.653] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.653] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.654] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.654] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0095.654] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x10b2, lpOverlapped=0x0) returned 1 [0095.655] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x10c0, lpOverlapped=0x0) returned 1 [0095.656] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0095.657] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.657] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.657] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x10b2, lpOverlapped=0x0) returned 1 [0095.657] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.659] FlushFileBuffers (hFile=0x22c) returned 1 [0095.661] CloseHandle (hObject=0x1ac) returned 1 [0095.661] CloseHandle (hObject=0x22c) returned 1 [0095.661] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0095.662] SetEvent (hEvent=0x144) returned 1 [0095.662] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.663] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=174440) returned 1 [0095.663] CloseHandle (hObject=0x22c) returned 1 [0095.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0095.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0095.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.664] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0095.664] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.664] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.664] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0095.664] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x2a968, lpOverlapped=0x0) returned 1 [0095.668] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x2a970, lpOverlapped=0x0) returned 1 [0095.672] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xe2, lpOverlapped=0x0) returned 1 [0095.672] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.672] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.672] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x2a968, lpOverlapped=0x0) returned 1 [0095.673] FlushFileBuffers (hFile=0x22c) returned 1 [0095.681] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.683] CloseHandle (hObject=0x22c) returned 1 [0095.683] CloseHandle (hObject=0x1ac) returned 1 [0095.683] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0095.688] SetEvent (hEvent=0x144) returned 1 [0095.689] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.689] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=7378792) returned 1 [0095.689] CloseHandle (hObject=0x1ac) returned 1 [0095.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0095.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0095.689] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.690] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.690] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.690] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0095.693] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.695] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0095.699] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0095.699] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0095.720] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0095.720] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0102, lpOverlapped=0x0) returned 1 [0095.738] SetEndOfFile (hFile=0x1ac) returned 1 [0095.738] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0095.738] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0095.739] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0095.739] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0095.741] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0095.741] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed013a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0095.743] FlushFileBuffers (hFile=0x1ac) returned 1 [0095.848] CloseHandle (hObject=0x1ac) returned 1 [0095.848] SetEvent (hEvent=0x144) returned 1 [0095.849] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.849] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1463568) returned 1 [0095.849] CloseHandle (hObject=0x1ac) returned 1 [0095.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0095.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0095.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0095.849] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.849] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.849] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0095.849] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x20c [0095.850] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x110100, lpOverlapped=0x0) returned 1 [0095.882] WriteFile (in: hFile=0x20c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x110100, lpOverlapped=0x0) returned 1 [0095.918] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x55410, lpOverlapped=0x0) returned 1 [0095.923] WriteFile (in: hFile=0x20c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x55420, lpOverlapped=0x0) returned 1 [0095.929] WriteFile (in: hFile=0x20c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0095.929] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.930] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0095.930] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x110102, lpOverlapped=0x0) returned 1 [0095.935] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x5540e, lpOverlapped=0x0) returned 1 [0095.936] FlushFileBuffers (hFile=0x1ac) returned 1 [0096.029] FlushFileBuffers (hFile=0x20c) returned 1 [0096.042] CloseHandle (hObject=0x1ac) returned 1 [0096.043] CloseHandle (hObject=0x20c) returned 1 [0096.043] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0096.054] SetEvent (hEvent=0x144) returned 1 [0096.055] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0096.080] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=27532288) returned 1 [0096.080] CloseHandle (hObject=0x1ac) returned 1 [0096.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0096.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0096.081] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0096.081] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.081] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.081] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.086] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.086] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.091] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.091] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.108] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0096.108] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0096.244] SetEndOfFile (hFile=0x1ac) returned 1 [0096.244] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.244] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.246] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.246] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.250] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.250] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.251] FlushFileBuffers (hFile=0x1ac) returned 1 [0096.391] CloseHandle (hObject=0x1ac) returned 1 [0096.391] SetEvent (hEvent=0x144) returned 1 [0096.392] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.397] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=222948913) returned 1 [0096.397] CloseHandle (hObject=0x22c) returned 1 [0096.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0096.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0096.398] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.398] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.398] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.398] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.406] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.406] ReadFile (in: hFile=0x22c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.413] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.413] ReadFile (in: hFile=0x22c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.425] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0096.425] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0096.448] SetEndOfFile (hFile=0x22c) returned 1 [0096.448] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.448] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.451] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.451] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.453] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.453] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.454] FlushFileBuffers (hFile=0x22c) returned 1 [0096.651] CloseHandle (hObject=0x22c) returned 1 [0096.659] SetEvent (hEvent=0x144) returned 1 [0096.669] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.687] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1992192) returned 1 [0096.689] CloseHandle (hObject=0x22c) returned 1 [0096.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0096.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0096.737] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.737] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.737] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.737] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.740] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.742] ReadFile (in: hFile=0x22c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.747] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0096.747] ReadFile (in: hFile=0x22c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0096.760] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0096.760] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0096.797] SetEndOfFile (hFile=0x22c) returned 1 [0096.797] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.798] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.800] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.800] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.802] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0096.802] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0096.803] FlushFileBuffers (hFile=0x22c) returned 1 [0096.891] CloseHandle (hObject=0x22c) returned 1 [0096.891] SetEvent (hEvent=0x144) returned 1 [0096.892] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.892] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1463568) returned 1 [0096.892] CloseHandle (hObject=0x22c) returned 1 [0096.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0096.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0096.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0096.893] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0096.893] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0096.893] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0096.893] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0096.893] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x110100, lpOverlapped=0x0) returned 1 [0096.933] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x110100, lpOverlapped=0x0) returned 1 [0096.972] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x55410, lpOverlapped=0x0) returned 1 [0096.977] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x55420, lpOverlapped=0x0) returned 1 [0096.983] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0096.983] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0096.983] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0096.984] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x110102, lpOverlapped=0x0) returned 1 [0096.991] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x5540e, lpOverlapped=0x0) returned 1 [0096.992] FlushFileBuffers (hFile=0x22c) returned 1 [0097.005] FlushFileBuffers (hFile=0x228) returned 1 [0097.119] CloseHandle (hObject=0x22c) returned 1 [0097.119] CloseHandle (hObject=0x228) returned 1 [0097.120] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0097.131] SetEvent (hEvent=0x144) returned 1 [0097.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0097.161] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=6421) returned 1 [0097.161] CloseHandle (hObject=0x218) returned 1 [0097.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0097.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0097.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.161] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0097.162] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.162] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.162] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x228 [0097.162] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x1915, lpOverlapped=0x0) returned 1 [0097.164] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x1920, lpOverlapped=0x0) returned 1 [0097.166] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0097.167] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.167] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.167] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x1915, lpOverlapped=0x0) returned 1 [0097.167] FlushFileBuffers (hFile=0x218) returned 1 [0097.170] FlushFileBuffers (hFile=0x228) returned 1 [0097.172] CloseHandle (hObject=0x218) returned 1 [0097.172] CloseHandle (hObject=0x228) returned 1 [0097.172] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0097.173] SetEvent (hEvent=0x144) returned 1 [0097.173] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0097.174] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=162970271) returned 1 [0097.174] CloseHandle (hObject=0x228) returned 1 [0097.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0097.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0097.174] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0097.174] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.174] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.174] ReadFile (in: hFile=0x228, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.181] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.181] ReadFile (in: hFile=0x228, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.185] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.185] ReadFile (in: hFile=0x228, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.197] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0097.198] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0097.215] SetEndOfFile (hFile=0x228) returned 1 [0097.215] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.215] WriteFile (in: hFile=0x228, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.218] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.218] WriteFile (in: hFile=0x228, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.222] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.223] WriteFile (in: hFile=0x228, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.223] FlushFileBuffers (hFile=0x228) returned 1 [0097.343] CloseHandle (hObject=0x228) returned 1 [0097.343] SetEvent (hEvent=0x144) returned 1 [0097.344] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0097.344] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=16683) returned 1 [0097.344] CloseHandle (hObject=0x228) returned 1 [0097.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0097.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0097.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.345] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0097.345] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.345] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.345] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0097.345] ReadFile (in: hFile=0x228, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x412b, lpOverlapped=0x0) returned 1 [0097.347] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x4130, lpOverlapped=0x0) returned 1 [0097.350] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0097.350] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.350] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.350] WriteFile (in: hFile=0x228, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x412b, lpOverlapped=0x0) returned 1 [0097.351] FlushFileBuffers (hFile=0x228) returned 1 [0097.354] FlushFileBuffers (hFile=0x1ac) returned 1 [0097.355] CloseHandle (hObject=0x228) returned 1 [0097.355] CloseHandle (hObject=0x1ac) returned 1 [0097.355] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0097.356] SetEvent (hEvent=0x144) returned 1 [0097.357] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.358] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1992192) returned 1 [0097.358] CloseHandle (hObject=0x1ac) returned 1 [0097.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0097.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0097.358] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.359] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.359] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.359] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.364] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.364] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.367] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.367] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.380] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0097.380] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0097.410] SetEndOfFile (hFile=0x1ac) returned 1 [0097.410] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.410] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.412] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.412] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.414] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.414] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.415] FlushFileBuffers (hFile=0x1ac) returned 1 [0097.555] CloseHandle (hObject=0x1ac) returned 1 [0097.555] SetEvent (hEvent=0x144) returned 1 [0097.556] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.556] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=36233052) returned 1 [0097.556] CloseHandle (hObject=0x1ac) returned 1 [0097.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0097.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0097.557] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.557] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.557] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.557] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.561] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.563] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.566] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0097.566] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0097.579] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0097.579] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0097.601] SetEndOfFile (hFile=0x1ac) returned 1 [0097.601] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.601] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.603] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.603] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.604] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0097.604] WriteFile (in: hFile=0x1ac, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0097.604] FlushFileBuffers (hFile=0x1ac) returned 1 [0097.791] CloseHandle (hObject=0x1ac) returned 1 [0097.792] SetEvent (hEvent=0x144) returned 1 [0097.792] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.793] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=715834) returned 1 [0097.793] CloseHandle (hObject=0x1ac) returned 1 [0097.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0097.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0097.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.793] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.793] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.793] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.794] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x22c [0097.794] ReadFile (in: hFile=0x1ac, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xaec3a, lpOverlapped=0x0) returned 1 [0097.808] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xaec40, lpOverlapped=0x0) returned 1 [0097.822] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x112, lpOverlapped=0x0) returned 1 [0097.822] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.822] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.822] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xaec3a, lpOverlapped=0x0) returned 1 [0097.824] FlushFileBuffers (hFile=0x1ac) returned 1 [0097.844] FlushFileBuffers (hFile=0x22c) returned 1 [0097.848] CloseHandle (hObject=0x1ac) returned 1 [0097.849] CloseHandle (hObject=0x22c) returned 1 [0097.849] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0097.855] SetEvent (hEvent=0x144) returned 1 [0097.855] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0097.856] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1377656) returned 1 [0097.856] CloseHandle (hObject=0x22c) returned 1 [0097.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0097.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0097.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0097.856] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0097.856] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.856] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0097.856] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0097.857] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x110100, lpOverlapped=0x0) returned 1 [0097.886] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x110100, lpOverlapped=0x0) returned 1 [0097.921] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x40478, lpOverlapped=0x0) returned 1 [0097.924] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x40480, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x40480, lpOverlapped=0x0) returned 1 [0097.930] WriteFile (in: hFile=0x1ac, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0097.930] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.930] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0097.930] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x110102, lpOverlapped=0x0) returned 1 [0097.935] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x40476, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x40476, lpOverlapped=0x0) returned 1 [0097.936] FlushFileBuffers (hFile=0x22c) returned 1 [0098.082] FlushFileBuffers (hFile=0x1ac) returned 1 [0098.258] CloseHandle (hObject=0x22c) returned 1 [0098.258] CloseHandle (hObject=0x1ac) returned 1 [0098.259] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0098.270] SetEvent (hEvent=0x144) returned 1 [0098.272] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.273] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=12060672) returned 1 [0098.273] CloseHandle (hObject=0x22c) returned 1 [0098.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0098.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 1 [0098.273] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.273] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0098.273] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0098.273] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e10058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0098.278] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0098.278] ReadFile (in: hFile=0x22c, lpBuffer=0x2e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e50058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0098.286] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x280f940 | out: lpNewFilePointer=0x0) returned 1 [0098.286] ReadFile (in: hFile=0x22c, lpBuffer=0x2e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x280f94c, lpOverlapped=0x0 | out: lpBuffer=0x2e90058*, lpNumberOfBytesRead=0x280f94c*=0x40000, lpOverlapped=0x0) returned 1 [0098.302] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab0 | out: lpNewFilePointer=0x0) returned 1 [0098.302] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x280faa8, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa8*=0xc0112, lpOverlapped=0x0) returned 1 [0098.322] SetEndOfFile (hFile=0x22c) returned 1 [0098.322] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0098.322] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0098.324] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0098.324] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0098.328] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f948 | out: lpNewFilePointer=0x0) returned 1 [0098.328] WriteFile (in: hFile=0x22c, lpBuffer=0x2ed014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x280f954, lpOverlapped=0x0 | out: lpBuffer=0x2ed014a*, lpNumberOfBytesWritten=0x280f954*=0x40000, lpOverlapped=0x0) returned 1 [0098.329] FlushFileBuffers (hFile=0x22c) returned 1 [0098.513] CloseHandle (hObject=0x22c) returned 1 [0098.513] SetEvent (hEvent=0x144) returned 1 [0098.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.517] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=994184) returned 1 [0098.517] CloseHandle (hObject=0x22c) returned 1 [0098.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0098.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0098.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0098.518] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0098.518] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0098.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x218 [0098.519] ReadFile (in: hFile=0x22c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xf2b88, lpOverlapped=0x0) returned 1 [0098.538] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2b90, lpOverlapped=0x0) returned 1 [0098.559] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0098.560] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0098.560] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0098.560] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2b88, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xf2b88, lpOverlapped=0x0) returned 1 [0098.624] FlushFileBuffers (hFile=0x22c) returned 1 [0098.664] FlushFileBuffers (hFile=0x218) returned 1 [0098.677] CloseHandle (hObject=0x22c) returned 1 [0098.677] CloseHandle (hObject=0x218) returned 1 [0098.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0098.687] SetEvent (hEvent=0x144) returned 1 [0098.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0098.688] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=64096) returned 1 [0098.688] CloseHandle (hObject=0x218) returned 1 [0098.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0098.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0098.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0098.688] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0098.688] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0098.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x22c [0098.733] ReadFile (in: hFile=0x218, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xfa60, lpOverlapped=0x0) returned 1 [0098.735] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xfa70, lpOverlapped=0x0) returned 1 [0098.737] WriteFile (in: hFile=0x22c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0098.737] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0098.737] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0098.737] WriteFile (in: hFile=0x218, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xfa60, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xfa60, lpOverlapped=0x0) returned 1 [0098.737] FlushFileBuffers (hFile=0x218) returned 1 [0098.757] FlushFileBuffers (hFile=0x22c) returned 1 [0098.758] CloseHandle (hObject=0x218) returned 1 [0098.758] CloseHandle (hObject=0x22c) returned 1 [0098.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0098.760] SetEvent (hEvent=0x144) returned 1 [0098.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0098.766] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=543304) returned 1 [0098.766] CloseHandle (hObject=0x214) returned 1 [0098.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0098.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0098.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0098.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0098.769] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0098.769] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0098.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c4 [0098.769] ReadFile (in: hFile=0x214, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x84a48, lpOverlapped=0x0) returned 1 [0098.779] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x84a50, lpOverlapped=0x0) returned 1 [0098.790] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0098.790] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0098.790] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0098.790] WriteFile (in: hFile=0x214, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x84a48, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x84a48, lpOverlapped=0x0) returned 1 [0098.791] FlushFileBuffers (hFile=0x214) returned 1 [0099.029] FlushFileBuffers (hFile=0x1c4) returned 1 [0099.133] CloseHandle (hObject=0x214) returned 1 [0099.133] CloseHandle (hObject=0x1c4) returned 1 [0099.133] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0099.203] SetEvent (hEvent=0x144) returned 1 [0099.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.204] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=7656) returned 1 [0099.204] CloseHandle (hObject=0x1c4) returned 1 [0099.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0099.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0099.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.205] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.205] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x214 [0099.205] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x1de8, lpOverlapped=0x0) returned 1 [0099.207] WriteFile (in: hFile=0x214, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x1df0, lpOverlapped=0x0) returned 1 [0099.208] WriteFile (in: hFile=0x214, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0099.208] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.208] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.208] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1de8, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x1de8, lpOverlapped=0x0) returned 1 [0099.208] FlushFileBuffers (hFile=0x1c4) returned 1 [0099.223] FlushFileBuffers (hFile=0x214) returned 1 [0099.225] CloseHandle (hObject=0x1c4) returned 1 [0099.225] CloseHandle (hObject=0x214) returned 1 [0099.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0099.226] SetEvent (hEvent=0x144) returned 1 [0099.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0099.227] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=31104) returned 1 [0099.227] CloseHandle (hObject=0x214) returned 1 [0099.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0099.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0099.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0099.227] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.227] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c4 [0099.227] ReadFile (in: hFile=0x214, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x7980, lpOverlapped=0x0) returned 1 [0099.230] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x7990, lpOverlapped=0x0) returned 1 [0099.231] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0099.231] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.231] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.231] WriteFile (in: hFile=0x214, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x7980, lpOverlapped=0x0) returned 1 [0099.231] FlushFileBuffers (hFile=0x214) returned 1 [0099.234] FlushFileBuffers (hFile=0x1c4) returned 1 [0099.237] CloseHandle (hObject=0x214) returned 1 [0099.237] CloseHandle (hObject=0x1c4) returned 1 [0099.237] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0099.238] SetEvent (hEvent=0x144) returned 1 [0099.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.240] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=38768) returned 1 [0099.240] CloseHandle (hObject=0x1c4) returned 1 [0099.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0099.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0099.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.240] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.240] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x214 [0099.242] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x9770, lpOverlapped=0x0) returned 1 [0099.244] WriteFile (in: hFile=0x214, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x9780, lpOverlapped=0x0) returned 1 [0099.245] WriteFile (in: hFile=0x214, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0099.245] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.245] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.245] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x9770, lpOverlapped=0x0) returned 1 [0099.246] FlushFileBuffers (hFile=0x1c4) returned 1 [0099.465] FlushFileBuffers (hFile=0x214) returned 1 [0099.475] CloseHandle (hObject=0x1c4) returned 1 [0099.475] CloseHandle (hObject=0x214) returned 1 [0099.475] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0099.476] SetEvent (hEvent=0x144) returned 1 [0099.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.478] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=1486736) returned 1 [0099.479] CloseHandle (hObject=0x1c4) returned 1 [0099.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0099.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0099.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.479] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.479] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0099.479] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x110100, lpOverlapped=0x0) returned 1 [0099.509] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x110100, lpOverlapped=0x0) returned 1 [0099.546] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x5ae90, lpOverlapped=0x0) returned 1 [0099.550] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5aea0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x5aea0, lpOverlapped=0x0) returned 1 [0099.555] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0099.555] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.556] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.556] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x110102, lpOverlapped=0x0) returned 1 [0099.561] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x5ae8e, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x5ae8e, lpOverlapped=0x0) returned 1 [0099.562] FlushFileBuffers (hFile=0x1c4) returned 1 [0099.625] FlushFileBuffers (hFile=0x19c) returned 1 [0099.676] CloseHandle (hObject=0x1c4) returned 1 [0099.677] CloseHandle (hObject=0x19c) returned 1 [0099.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0099.689] SetEvent (hEvent=0x144) returned 1 [0099.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.690] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=6811) returned 1 [0099.690] CloseHandle (hObject=0x19c) returned 1 [0099.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0099.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0099.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0099.690] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.690] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c4 [0099.691] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x1a9b, lpOverlapped=0x0) returned 1 [0099.693] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x1aa0, lpOverlapped=0x0) returned 1 [0099.694] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0099.694] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.694] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.695] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x1a9b, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x1a9b, lpOverlapped=0x0) returned 1 [0099.695] FlushFileBuffers (hFile=0x19c) returned 1 [0099.698] FlushFileBuffers (hFile=0x1c4) returned 1 [0099.700] CloseHandle (hObject=0x19c) returned 1 [0099.700] CloseHandle (hObject=0x1c4) returned 1 [0099.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0099.701] SetEvent (hEvent=0x144) returned 1 [0099.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.702] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=323936) returned 1 [0099.702] CloseHandle (hObject=0x1c4) returned 1 [0099.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0099.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0099.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0099.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.703] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0099.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0099.703] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x4f160, lpOverlapped=0x0) returned 1 [0099.709] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x4f170, lpOverlapped=0x0) returned 1 [0099.714] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0099.715] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.715] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0099.715] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x4f160, lpOverlapped=0x0) returned 1 [0099.716] FlushFileBuffers (hFile=0x1c4) returned 1 [0100.137] FlushFileBuffers (hFile=0x19c) returned 1 [0100.247] CloseHandle (hObject=0x1c4) returned 1 [0100.247] CloseHandle (hObject=0x19c) returned 1 [0100.247] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0100.250] SetEvent (hEvent=0x144) returned 1 [0100.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.325] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=606062) returned 1 [0100.325] CloseHandle (hObject=0x19c) returned 1 [0100.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0100.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0100.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0100.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0100.325] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0100.325] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0100.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c4 [0100.326] ReadFile (in: hFile=0x19c, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x93f6e, lpOverlapped=0x0) returned 1 [0100.338] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x93f70, lpOverlapped=0x0) returned 1 [0100.364] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0100.364] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0100.364] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0100.364] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x93f6e, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x93f6e, lpOverlapped=0x0) returned 1 [0100.366] FlushFileBuffers (hFile=0x19c) returned 1 [0100.581] FlushFileBuffers (hFile=0x1c4) returned 1 [0100.590] CloseHandle (hObject=0x19c) returned 1 [0100.590] CloseHandle (hObject=0x1c4) returned 1 [0100.591] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0100.596] SetEvent (hEvent=0x144) returned 1 [0100.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0100.596] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=712592) returned 1 [0100.596] CloseHandle (hObject=0x1c4) returned 1 [0100.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0100.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0100.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0100.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0100.597] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0100.597] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0100.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0100.597] ReadFile (in: hFile=0x1c4, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0xadf90, lpOverlapped=0x0) returned 1 [0100.613] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xadfa0, lpOverlapped=0x0) returned 1 [0100.627] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0100.627] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0100.627] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0100.627] WriteFile (in: hFile=0x1c4, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0xadf90, lpOverlapped=0x0) returned 1 [0100.629] FlushFileBuffers (hFile=0x1c4) returned 1 [0101.362] FlushFileBuffers (hFile=0x19c) returned 1 [0101.713] CloseHandle (hObject=0x1c4) returned 1 [0101.713] CloseHandle (hObject=0x19c) returned 1 [0101.713] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0101.719] SetEvent (hEvent=0x144) returned 1 [0101.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0101.791] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x280faf0 | out: lpFileSize=0x280faf0*=241024) returned 1 [0101.791] CloseHandle (hObject=0x210) returned 1 [0101.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0101.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0101.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0101.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0101.791] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0101.791] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280fab8 | out: lpNewFilePointer=0x0) returned 1 [0101.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0101.791] ReadFile (in: hFile=0x210, lpBuffer=0x2e10020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x280facc, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesRead=0x280facc*=0x3ad80, lpOverlapped=0x0) returned 1 [0101.796] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0x3ad90, lpOverlapped=0x0) returned 1 [0101.802] WriteFile (in: hFile=0x19c, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x280faa4, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280faa4*=0xf2, lpOverlapped=0x0) returned 1 [0101.803] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0101.803] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x280f818 | out: lpNewFilePointer=0x0) returned 1 [0101.803] WriteFile (in: hFile=0x210, lpBuffer=0x2e10020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x280f824, lpOverlapped=0x0 | out: lpBuffer=0x2e10020*, lpNumberOfBytesWritten=0x280f824*=0x3ad80, lpOverlapped=0x0) returned 1 [0101.804] FlushFileBuffers (hFile=0x210) Thread: id = 16 os_tid = 0xb14 [0079.893] GetProcessHeap () returned 0x840000 [0079.893] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b742b8 [0079.894] GetProcessHeap () returned 0x840000 [0079.894] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x10000) returned 0x2b842c0 [0079.894] GetProcessHeap () returned 0x840000 [0079.894] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x28) returned 0x2b11298 [0079.894] GetProcessHeap () returned 0x840000 [0079.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x110102) returned 0x2f30020 [0079.895] GetProcessHeap () returned 0x840000 [0079.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x50) returned 0x8634d8 [0079.895] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0079.895] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0079.895] Wow64DisableWow64FsRedirection (in: OldValue=0x292f968 | out: OldValue=0x292f968*=0x0) returned 1 [0079.895] GetProcessHeap () returned 0x840000 [0079.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8634d8 | out: hHeap=0x840000) returned 1 [0079.895] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.895] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.895] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.895] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.896] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.897] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.898] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.899] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.900] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.901] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.902] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.903] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.904] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.905] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.906] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.907] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.908] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.909] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.911] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.912] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.913] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.915] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.916] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.916] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.916] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0079.916] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0088.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0088.113] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x292f910 | out: lpFileSize=0x292f910*=2113536) returned 1 [0088.114] CloseHandle (hObject=0x200) returned 1 [0088.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 0x20 [0088.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 0x20 [0088.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0088.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0088.114] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8d8 | out: lpNewFilePointer=0x0) returned 1 [0088.114] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8d8 | out: lpNewFilePointer=0x0) returned 1 [0088.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1ac [0088.114] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0088.183] WriteFile (in: hFile=0x1ac, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0088.214] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0xf3f00, lpOverlapped=0x0) returned 1 [0088.240] WriteFile (in: hFile=0x1ac, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0xf3f10, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0xf3f10, lpOverlapped=0x0) returned 1 [0088.258] WriteFile (in: hFile=0x1ac, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0xf2, lpOverlapped=0x0) returned 1 [0088.259] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f638 | out: lpNewFilePointer=0x0) returned 1 [0088.259] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f638 | out: lpNewFilePointer=0x0) returned 1 [0088.259] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0088.426] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0xf3efe, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0xf3efe, lpOverlapped=0x0) returned 1 [0088.439] FlushFileBuffers (hFile=0x200) returned 1 [0089.312] FlushFileBuffers (hFile=0x1ac) returned 1 [0089.319] CloseHandle (hObject=0x200) returned 1 [0089.529] CloseHandle (hObject=0x1ac) returned 1 [0089.574] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 1 [0089.575] ResetEvent (hEvent=0x158) returned 1 [0089.575] SetEvent (hEvent=0x15c) returned 1 [0089.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0089.575] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x292f910 | out: lpFileSize=0x292f910*=11767808) returned 1 [0089.575] CloseHandle (hObject=0x1ac) returned 1 [0089.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 0x20 [0089.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 0x20 [0089.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0089.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0089.625] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8d8 | out: lpNewFilePointer=0x0) returned 1 [0089.625] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8d8 | out: lpNewFilePointer=0x0) returned 1 [0089.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x22c [0089.669] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0089.705] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0089.763] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0089.836] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0089.898] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0089.933] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0089.961] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0089.997] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.070] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0090.090] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.123] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0090.238] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.262] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0090.365] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.443] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0090.464] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.492] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0090.515] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.589] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0090.610] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0090.732] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x98600, lpOverlapped=0x0) returned 1 [0090.752] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x98610, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x98610, lpOverlapped=0x0) returned 1 [0090.866] WriteFile (in: hFile=0x22c, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0xf2, lpOverlapped=0x0) returned 1 [0090.866] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f638 | out: lpNewFilePointer=0x0) returned 1 [0090.867] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f638 | out: lpNewFilePointer=0x0) returned 1 [0090.867] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0090.881] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0090.894] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.038] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.052] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.181] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.195] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.209] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.289] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x110102, lpOverlapped=0x0) returned 1 [0091.303] WriteFile (in: hFile=0x200, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x985ec, lpNumberOfBytesWritten=0x292f644, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f644*=0x985ec, lpOverlapped=0x0) returned 1 [0091.314] FlushFileBuffers (hFile=0x200) returned 1 [0092.912] FlushFileBuffers (hFile=0x22c) returned 1 [0093.563] CloseHandle (hObject=0x200) returned 1 [0093.615] CloseHandle (hObject=0x22c) returned 1 [0093.616] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 1 [0093.619] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0xffffffff) returned 0x0 [0099.835] ResetEvent (hEvent=0x158) returned 1 [0099.835] SetEvent (hEvent=0x15c) returned 1 [0099.835] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0099.836] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x292f910 | out: lpFileSize=0x292f910*=75563008) returned 1 [0099.836] CloseHandle (hObject=0x200) returned 1 [0099.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x2020 [0099.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x2020 [0099.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.id[9c354b42-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0099.837] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0099.837] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8d8 | out: lpNewFilePointer=0x0) returned 1 [0099.837] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8d8 | out: lpNewFilePointer=0x0) returned 1 [0099.837] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.id[9C354B42-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.id[9c354b42-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x208 [0099.837] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0099.976] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.032] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.120] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.194] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.235] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.317] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.422] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.446] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.526] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.671] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.768] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.791] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.822] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0100.846] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0100.942] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0101.194] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0101.221] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0101.294] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0101.333] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0101.374] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0101.395] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0101.680] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 [0101.754] WriteFile (in: hFile=0x208, lpBuffer=0x2f30020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x292f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesWritten=0x292f8c4*=0x110100, lpOverlapped=0x0) returned 1 [0101.774] ReadFile (in: hFile=0x200, lpBuffer=0x2f30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x292f8ec, lpOverlapped=0x0 | out: lpBuffer=0x2f30020*, lpNumberOfBytesRead=0x292f8ec*=0x110100, lpOverlapped=0x0) returned 1 Thread: id = 17 os_tid = 0xb18 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\syswow64\\svchost.exe" page_root = "0x4bbc6000" os_pid = "0xa40" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa28" cmd_line = "\"C:\\Windows\\SysWOW64\\svchost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xa44 Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xd3be000" os_pid = "0x254" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00006dab" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 18 os_tid = 0x258 Thread: id = 19 os_tid = 0x260 Thread: id = 20 os_tid = 0x264 Thread: id = 21 os_tid = 0x268 Thread: id = 22 os_tid = 0x26c Thread: id = 23 os_tid = 0x270 Thread: id = 24 os_tid = 0x274 Thread: id = 25 os_tid = 0x278 Thread: id = 26 os_tid = 0x27c Thread: id = 27 os_tid = 0x280 Thread: id = 28 os_tid = 0x284 Thread: id = 29 os_tid = 0x288 Thread: id = 30 os_tid = 0x294 Thread: id = 32 os_tid = 0x2a0 Thread: id = 33 os_tid = 0x2a4 Thread: id = 35 os_tid = 0x2ac Thread: id = 59 os_tid = 0x348 Thread: id = 215 os_tid = 0x5ec Thread: id = 233 os_tid = 0x654 Thread: id = 239 os_tid = 0x668 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x247fa000" os_pid = "0x298" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b288" [0xc000000f], "LOCAL" [0x7] Thread: id = 31 os_tid = 0x29c Thread: id = 34 os_tid = 0x2a8 Thread: id = 36 os_tid = 0x2b0 Thread: id = 37 os_tid = 0x2b4 Thread: id = 38 os_tid = 0x2b8 Thread: id = 39 os_tid = 0x2bc Thread: id = 40 os_tid = 0x2c0 Thread: id = 41 os_tid = 0x2c4 Thread: id = 232 os_tid = 0x648 Thread: id = 234 os_tid = 0x658 Thread: id = 237 os_tid = 0x660 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2b108000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b566" [0xc000000f], "LOCAL" [0x7] Thread: id = 42 os_tid = 0x2cc Thread: id = 43 os_tid = 0x2d8 Thread: id = 44 os_tid = 0x2e0 Thread: id = 45 os_tid = 0x2e8 Thread: id = 46 os_tid = 0x2ec Thread: id = 47 os_tid = 0x300 Thread: id = 48 os_tid = 0x304 Thread: id = 61 os_tid = 0x358 Thread: id = 63 os_tid = 0x360 Thread: id = 64 os_tid = 0x364 Thread: id = 65 os_tid = 0x368 Thread: id = 66 os_tid = 0x36c Thread: id = 81 os_tid = 0x3ac Thread: id = 82 os_tid = 0x3b0 Thread: id = 83 os_tid = 0x3b4 Thread: id = 86 os_tid = 0x3c4 Thread: id = 88 os_tid = 0x3cc Thread: id = 133 os_tid = 0x410 Thread: id = 137 os_tid = 0x420 Thread: id = 142 os_tid = 0x438 Thread: id = 146 os_tid = 0x44c Thread: id = 151 os_tid = 0x460 Thread: id = 152 os_tid = 0x464 Thread: id = 176 os_tid = 0x524 Thread: id = 181 os_tid = 0x53c Thread: id = 183 os_tid = 0x544 Thread: id = 184 os_tid = 0x550 Thread: id = 187 os_tid = 0x55c Thread: id = 189 os_tid = 0x564 Thread: id = 337 os_tid = 0x218 Thread: id = 348 os_tid = 0x56c Thread: id = 351 os_tid = 0x5a8 Thread: id = 378 os_tid = 0x778 Thread: id = 404 os_tid = 0x7ec Thread: id = 408 os_tid = 0x328 Process: id = "7" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0x1ebc3000" os_pid = "0x314" os_integrity_level = "0x4000" os_privileges = "0x60b16000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x298" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 49 os_tid = 0x340 Thread: id = 50 os_tid = 0x33c Thread: id = 51 os_tid = 0x338 Thread: id = 52 os_tid = 0x32c Thread: id = 53 os_tid = 0x328 Thread: id = 54 os_tid = 0x324 Thread: id = 55 os_tid = 0x320 Thread: id = 56 os_tid = 0x31c Thread: id = 57 os_tid = 0x318 Thread: id = 58 os_tid = 0x344 Thread: id = 338 os_tid = 0x138 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xba11000" os_pid = "0x350" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c9a1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 60 os_tid = 0x354 Thread: id = 62 os_tid = 0x35c Thread: id = 67 os_tid = 0x370 Thread: id = 68 os_tid = 0x374 Thread: id = 69 os_tid = 0x378 Thread: id = 71 os_tid = 0x384 Thread: id = 73 os_tid = 0x38c Thread: id = 74 os_tid = 0x390 Thread: id = 75 os_tid = 0x394 Thread: id = 77 os_tid = 0x39c Thread: id = 91 os_tid = 0x3d8 Thread: id = 93 os_tid = 0x3e0 Thread: id = 95 os_tid = 0x3f0 Thread: id = 96 os_tid = 0x3f4 Thread: id = 99 os_tid = 0xc8 Thread: id = 100 os_tid = 0xf0 Thread: id = 108 os_tid = 0x140 Thread: id = 109 os_tid = 0x15c Thread: id = 130 os_tid = 0x21c Thread: id = 131 os_tid = 0x294 Thread: id = 141 os_tid = 0x434 Thread: id = 143 os_tid = 0x43c Thread: id = 204 os_tid = 0x5b4 Thread: id = 205 os_tid = 0x5c0 Thread: id = 206 os_tid = 0x5c8 Thread: id = 207 os_tid = 0x5cc Thread: id = 209 os_tid = 0x5d4 Thread: id = 250 os_tid = 0x6a8 Thread: id = 251 os_tid = 0x6ac Thread: id = 252 os_tid = 0x6b0 Thread: id = 258 os_tid = 0x6cc Thread: id = 375 os_tid = 0x770 Thread: id = 382 os_tid = 0x6e8 Thread: id = 386 os_tid = 0x3b0 Thread: id = 387 os_tid = 0x378 Thread: id = 388 os_tid = 0x30c Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9d19000" os_pid = "0x37c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cfd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 70 os_tid = 0x380 Thread: id = 72 os_tid = 0x388 Thread: id = 76 os_tid = 0x398 Thread: id = 78 os_tid = 0x3a0 Thread: id = 79 os_tid = 0x3a4 Thread: id = 80 os_tid = 0x3a8 Thread: id = 92 os_tid = 0x3dc Thread: id = 94 os_tid = 0x3ec Thread: id = 97 os_tid = 0x3f8 Thread: id = 98 os_tid = 0x3fc Thread: id = 103 os_tid = 0x12c Thread: id = 104 os_tid = 0x128 Thread: id = 112 os_tid = 0x1c4 Thread: id = 113 os_tid = 0x21c Thread: id = 121 os_tid = 0x2b4 Thread: id = 134 os_tid = 0x418 Thread: id = 157 os_tid = 0x47c Thread: id = 159 os_tid = 0x484 Thread: id = 161 os_tid = 0x48c Thread: id = 162 os_tid = 0x414 Thread: id = 163 os_tid = 0x490 Thread: id = 164 os_tid = 0x494 Thread: id = 165 os_tid = 0x4bc Thread: id = 208 os_tid = 0x5d0 Thread: id = 210 os_tid = 0x5d8 Thread: id = 211 os_tid = 0x5dc Thread: id = 212 os_tid = 0x5e0 Thread: id = 213 os_tid = 0x5e4 Thread: id = 214 os_tid = 0x5e8 Thread: id = 216 os_tid = 0x5f0 Thread: id = 217 os_tid = 0x5f4 Thread: id = 218 os_tid = 0x5f8 Thread: id = 219 os_tid = 0x5fc Thread: id = 220 os_tid = 0x600 Thread: id = 221 os_tid = 0x604 Thread: id = 222 os_tid = 0x610 Thread: id = 223 os_tid = 0x614 Thread: id = 224 os_tid = 0x624 Thread: id = 225 os_tid = 0x62c Thread: id = 226 os_tid = 0x630 Thread: id = 227 os_tid = 0x634 Thread: id = 228 os_tid = 0x638 Thread: id = 242 os_tid = 0x678 Thread: id = 246 os_tid = 0x68c Thread: id = 257 os_tid = 0x6c8 Thread: id = 259 os_tid = 0x6d0 Thread: id = 260 os_tid = 0x6d4 Thread: id = 262 os_tid = 0x6dc Thread: id = 263 os_tid = 0x6e0 Thread: id = 264 os_tid = 0x6f0 Thread: id = 265 os_tid = 0x6f4 Thread: id = 302 os_tid = 0x788 Thread: id = 383 os_tid = 0x158 Thread: id = 384 os_tid = 0x154 Thread: id = 391 os_tid = 0x480 Thread: id = 392 os_tid = 0x638 Thread: id = 393 os_tid = 0x634 Thread: id = 394 os_tid = 0x7cc Thread: id = 395 os_tid = 0x110 Thread: id = 396 os_tid = 0x430 Thread: id = 397 os_tid = 0x41c Thread: id = 398 os_tid = 0x458 Thread: id = 399 os_tid = 0x478 Thread: id = 400 os_tid = 0x7f8 Thread: id = 401 os_tid = 0x7f4 Thread: id = 402 os_tid = 0x404 Process: id = "10" image_name = "audiodg.exe" filename = "c:\\windows\\system32\\audiodg.exe" page_root = "0x95d7000" os_pid = "0x3b8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x2c8" cmd_line = "C:\\Windows\\system32\\AUDIODG.EXE 0x318" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b566" [0xc000000f], "LOCAL" [0x7] Thread: id = 84 os_tid = 0x3bc Thread: id = 85 os_tid = 0x3c0 Thread: id = 87 os_tid = 0x3c8 Thread: id = 89 os_tid = 0x3d0 Thread: id = 90 os_tid = 0x3d4 Thread: id = 359 os_tid = 0x5f4 Thread: id = 366 os_tid = 0x714 Thread: id = 370 os_tid = 0x710 Thread: id = 377 os_tid = 0x774 Thread: id = 379 os_tid = 0x764 Thread: id = 380 os_tid = 0x768 Thread: id = 407 os_tid = 0x338 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9126000" os_pid = "0x11c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dd4b" [0xc000000f], "LOCAL" [0x7] Thread: id = 101 os_tid = 0x118 Thread: id = 102 os_tid = 0x120 Thread: id = 105 os_tid = 0x130 Thread: id = 106 os_tid = 0x150 Thread: id = 107 os_tid = 0x154 Thread: id = 110 os_tid = 0x174 Thread: id = 111 os_tid = 0x124 Thread: id = 135 os_tid = 0x41c Thread: id = 198 os_tid = 0x58c Thread: id = 229 os_tid = 0x63c Thread: id = 230 os_tid = 0x640 Thread: id = 231 os_tid = 0x644 Thread: id = 243 os_tid = 0x67c Thread: id = 244 os_tid = 0x680 Thread: id = 245 os_tid = 0x684 Thread: id = 255 os_tid = 0x6c0 Thread: id = 256 os_tid = 0x6c4 Thread: id = 261 os_tid = 0x6d8 Thread: id = 266 os_tid = 0x6f8 Thread: id = 303 os_tid = 0x78c Thread: id = 405 os_tid = 0x7e8 Thread: id = 409 os_tid = 0x324 Process: id = "12" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x7734000" os_pid = "0x134" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cfd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 114 os_tid = 0x1d8 Thread: id = 115 os_tid = 0x230 Thread: id = 116 os_tid = 0x218 Thread: id = 117 os_tid = 0x138 Thread: id = 118 os_tid = 0x268 Thread: id = 119 os_tid = 0x110 Thread: id = 120 os_tid = 0x294 Process: id = "13" image_name = "slui.exe" filename = "c:\\windows\\system32\\slui.exe" page_root = "0x6c56000" os_pid = "0x30c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x298" cmd_line = "\"C:\\Windows\\system32\\slui.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 122 os_tid = 0x3ac Thread: id = 123 os_tid = 0x384 Thread: id = 124 os_tid = 0x378 Thread: id = 125 os_tid = 0x3b0 Thread: id = 126 os_tid = 0x3dc Thread: id = 127 os_tid = 0x158 Thread: id = 128 os_tid = 0x178 Thread: id = 129 os_tid = 0x154 Process: id = "14" image_name = "dwm.exe" filename = "c:\\windows\\system32\\dwm.exe" page_root = "0x788e000" os_pid = "0x408" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x350" cmd_line = "\"C:\\Windows\\system32\\Dwm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 132 os_tid = 0x40c Thread: id = 136 os_tid = 0x424 Thread: id = 138 os_tid = 0x428 Thread: id = 139 os_tid = 0x42c Thread: id = 140 os_tid = 0x430 Thread: id = 341 os_tid = 0x488 Thread: id = 343 os_tid = 0x36c Thread: id = 413 os_tid = 0x31c Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7246000" os_pid = "0x440" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f9e7" [0xc000000f], "LOCAL" [0x7] Thread: id = 144 os_tid = 0x444 Thread: id = 145 os_tid = 0x448 Thread: id = 147 os_tid = 0x450 Thread: id = 148 os_tid = 0x454 Thread: id = 149 os_tid = 0x458 Thread: id = 150 os_tid = 0x45c Thread: id = 153 os_tid = 0x46c Thread: id = 154 os_tid = 0x470 Thread: id = 155 os_tid = 0x474 Thread: id = 156 os_tid = 0x478 Thread: id = 158 os_tid = 0x480 Thread: id = 160 os_tid = 0x488 Thread: id = 179 os_tid = 0x534 Thread: id = 180 os_tid = 0x538 Thread: id = 185 os_tid = 0x554 Thread: id = 186 os_tid = 0x558 Thread: id = 190 os_tid = 0x56c Thread: id = 191 os_tid = 0x570 Thread: id = 196 os_tid = 0x584 Thread: id = 199 os_tid = 0x590 Thread: id = 201 os_tid = 0x598 Thread: id = 202 os_tid = 0x59c Thread: id = 203 os_tid = 0x5a0 Thread: id = 235 os_tid = 0x568 Thread: id = 247 os_tid = 0x694 Thread: id = 267 os_tid = 0x6fc Thread: id = 268 os_tid = 0x700 Thread: id = 271 os_tid = 0x70c Thread: id = 410 os_tid = 0x364 Process: id = "16" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x77b7000" os_pid = "0x4d0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00010c46" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 166 os_tid = 0x4d4 Thread: id = 167 os_tid = 0x4e4 Thread: id = 168 os_tid = 0x4f0 Thread: id = 169 os_tid = 0x4fc Thread: id = 170 os_tid = 0x500 Thread: id = 171 os_tid = 0x504 Thread: id = 172 os_tid = 0x510 Thread: id = 173 os_tid = 0x518 Thread: id = 174 os_tid = 0x51c Thread: id = 175 os_tid = 0x520 Thread: id = 177 os_tid = 0x52c Thread: id = 178 os_tid = 0x530 Thread: id = 182 os_tid = 0x540 Thread: id = 188 os_tid = 0x560 Thread: id = 192 os_tid = 0x574 Thread: id = 193 os_tid = 0x578 Thread: id = 194 os_tid = 0x57c Thread: id = 195 os_tid = 0x580 Thread: id = 197 os_tid = 0x588 Thread: id = 200 os_tid = 0x594 Thread: id = 236 os_tid = 0x65c Thread: id = 238 os_tid = 0x664 Thread: id = 240 os_tid = 0x66c Thread: id = 249 os_tid = 0x6a4 Thread: id = 289 os_tid = 0x748 Thread: id = 290 os_tid = 0x74c Thread: id = 291 os_tid = 0x750 Thread: id = 412 os_tid = 0x138 Thread: id = 414 os_tid = 0x320 Process: id = "17" image_name = "drvinst.exe" filename = "c:\\windows\\system32\\drvinst.exe" page_root = "0x7a86d000" os_pid = "0x670" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x254" cmd_line = "DrvInst.exe \"1\" \"200\" \"acpi\\genuineintel_-_intel64_family_6_model_85_-_intel(r)_core(tm)_i5-7500_cpu_@_3.40ghz\\_0\" \"\" \"\" \"66f46a933\" \"0000000000000000\" \"0000000000000558\" \"0000000000000308\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xe], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xe], "NT AUTHORITY\\Logon Session 00000000:00006dab" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 241 os_tid = 0x674 Thread: id = 248 os_tid = 0x698 Thread: id = 253 os_tid = 0x6b8 Thread: id = 254 os_tid = 0x6bc Thread: id = 269 os_tid = 0x704 Thread: id = 270 os_tid = 0x708 Thread: id = 272 os_tid = 0x710 Thread: id = 273 os_tid = 0x714 Process: id = "18" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x609b000" os_pid = "0x4c8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x298" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 274 os_tid = 0x6b4 Thread: id = 275 os_tid = 0x5b0 Thread: id = 276 os_tid = 0x5ac Thread: id = 277 os_tid = 0x5a4 Thread: id = 278 os_tid = 0x4f4 Thread: id = 279 os_tid = 0x4ec Thread: id = 280 os_tid = 0x4e8 Thread: id = 281 os_tid = 0x4dc Thread: id = 282 os_tid = 0x4cc Thread: id = 283 os_tid = 0x718 Thread: id = 293 os_tid = 0x75c Thread: id = 294 os_tid = 0x760 Thread: id = 403 os_tid = 0x7e4 Thread: id = 411 os_tid = 0x344 Process: id = "19" image_name = "rundll32.exe" filename = "c:\\windows\\system32\\rundll32.exe" page_root = "0x791ab000" os_pid = "0x720" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x254" cmd_line = "rundll32.exe C:\\Windows\\system32\\newdev.dll,pDiDeviceInstallNotification \\\\.\\pipe\\PNP_Device_Install_Pipe_1.{d1d17275-4a05-406f-9eda-cee6e093b01b} \"(null)\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 284 os_tid = 0x724 Thread: id = 285 os_tid = 0x72c Thread: id = 286 os_tid = 0x730 Thread: id = 287 os_tid = 0x740 Thread: id = 288 os_tid = 0x744 Thread: id = 331 os_tid = 0x43c Process: id = "20" image_name = "dinotify.exe" filename = "c:\\windows\\system32\\dinotify.exe" page_root = "0x77434000" os_pid = "0x754" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0x720" cmd_line = "\"C:\\Windows\\System32\\dinotify.exe\" pnpui.dll,SimplifiedDINotification" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 292 os_tid = 0x758 Thread: id = 324 os_tid = 0x7e4 Process: id = "21" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x79114000" os_pid = "0x6e8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x298" cmd_line = "taskhost.exe SYSTEM" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 295 os_tid = 0x770 Thread: id = 296 os_tid = 0x76c Thread: id = 297 os_tid = 0x768 Thread: id = 298 os_tid = 0x764 Thread: id = 299 os_tid = 0x6ec Thread: id = 300 os_tid = 0x774 Thread: id = 301 os_tid = 0x778 Process: id = "22" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x76557000" os_pid = "0x798" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x298" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 304 os_tid = 0x7a8 Thread: id = 305 os_tid = 0x7a4 Thread: id = 306 os_tid = 0x7a0 Thread: id = 307 os_tid = 0x79c Thread: id = 308 os_tid = 0x7ac Thread: id = 309 os_tid = 0x7b0 Thread: id = 310 os_tid = 0x7b4 Thread: id = 311 os_tid = 0x7b8 Thread: id = 312 os_tid = 0x7bc Thread: id = 313 os_tid = 0x7c0 Thread: id = 314 os_tid = 0x7c4 Thread: id = 315 os_tid = 0x7c8 Thread: id = 316 os_tid = 0x7cc Thread: id = 317 os_tid = 0x7d0 Thread: id = 318 os_tid = 0x7d4 Thread: id = 319 os_tid = 0x7d8 Thread: id = 320 os_tid = 0x7dc Thread: id = 321 os_tid = 0x7e0 Thread: id = 322 os_tid = 0x7f0 Thread: id = 323 os_tid = 0x480 Thread: id = 332 os_tid = 0x368 Thread: id = 333 os_tid = 0x110 Thread: id = 334 os_tid = 0x268 Thread: id = 336 os_tid = 0x230 Thread: id = 339 os_tid = 0x1d8 Thread: id = 345 os_tid = 0x53c Thread: id = 346 os_tid = 0x538 Thread: id = 349 os_tid = 0x570 Thread: id = 350 os_tid = 0x508 Thread: id = 357 os_tid = 0x54c Thread: id = 358 os_tid = 0x5d8 Thread: id = 361 os_tid = 0x63c Thread: id = 362 os_tid = 0x6a0 Thread: id = 365 os_tid = 0x71c Thread: id = 367 os_tid = 0x708 Thread: id = 368 os_tid = 0x6bc Thread: id = 371 os_tid = 0x674 Thread: id = 372 os_tid = 0x670 Thread: id = 376 os_tid = 0x77c Thread: id = 385 os_tid = 0x178 Thread: id = 406 os_tid = 0x32c Process: id = "23" image_name = "bcssync.exe" filename = "c:\\program files\\microsoft office\\office14\\bcssync.exe" page_root = "0x744c5000" os_pid = "0x7e8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x798" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 325 os_tid = 0x7ec Process: id = "24" image_name = "svchost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\svchost.exe" page_root = "0x75228000" os_pid = "0x7f4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x798" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 326 os_tid = 0x7f8 [0167.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f780 | out: lpSystemTimeAsFileTime=0x20f780*(dwLowDateTime=0xd3d19d80, dwHighDateTime=0x1d581c5)) [0167.889] GetCurrentProcessId () returned 0x7f4 [0167.889] GetCurrentThreadId () returned 0x7f8 [0167.889] GetTickCount () returned 0x1136893 [0167.889] QueryPerformanceCounter (in: lpPerformanceCount=0x20f778 | out: lpPerformanceCount=0x20f778*=9762055712) returned 1 [0167.890] GetModuleHandleA (lpModuleName=0x0) returned 0x270000 [0167.890] __set_app_type (_Type=0x2) [0167.890] __p__fmode () returned 0x755331f4 [0167.890] __p__commode () returned 0x755331fc [0167.890] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x273791) returned 0x0 [0167.891] __wgetmainargs (in: _Argc=0x2750b8, _Argv=0x2750c0, _Env=0x2750bc, _DoWildCard=0, _StartInfo=0x275050 | out: _Argc=0x2750b8, _Argv=0x2750c0, _Env=0x2750bc) returned 0 [0167.891] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x273a75) returned 0x273791 [0167.891] SetErrorMode (uMode=0x1) returned 0x0 [0167.891] GetProcessHeap () returned 0x290000 [0167.891] RegDisablePredefinedCacheEx () returned 0x0 [0167.891] EtwEventRegister () returned 0x5 [0167.892] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe\" " [0167.892] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe\" ") returned 58 [0167.892] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb2) returned 0x2a0610 [0167.892] LCMapStringW (in: Locale=0x400, dwMapFlags=0x100, lpSrcStr="\"C:\\Users\\5p5NrGJn0jS", cchSrc=22, lpDestStr=0x2a064c, cchDest=22 | out: lpDestStr="\"c:\\users\\5p5nrgjn0js") returned 22 [0167.892] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a0610 | out: hHeap=0x290000) returned 1 [0167.892] ExitProcess (uExitCode=0x0) Process: id = "25" image_name = "svchost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\svchost.exe" page_root = "0x75d30000" os_pid = "0x7fc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x798" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 327 os_tid = 0x404 [0167.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fc54 | out: lpSystemTimeAsFileTime=0x16fc54*(dwLowDateTime=0xd3d19d80, dwHighDateTime=0x1d581c5)) [0167.894] GetCurrentProcessId () returned 0x7fc [0167.894] GetCurrentThreadId () returned 0x404 [0167.894] GetTickCount () returned 0x1136893 [0167.894] QueryPerformanceCounter (in: lpPerformanceCount=0x16fc4c | out: lpPerformanceCount=0x16fc4c*=9762474713) returned 1 [0167.894] GetModuleHandleA (lpModuleName=0x0) returned 0x270000 [0167.894] __set_app_type (_Type=0x2) [0167.894] __p__fmode () returned 0x755331f4 [0167.895] __p__commode () returned 0x755331fc [0167.895] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x273791) returned 0x0 [0167.895] __wgetmainargs (in: _Argc=0x2750b8, _Argv=0x2750c0, _Env=0x2750bc, _DoWildCard=0, _StartInfo=0x275050 | out: _Argc=0x2750b8, _Argv=0x2750c0, _Env=0x2750bc) returned 0 [0167.895] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x273a75) returned 0x273791 [0167.895] SetErrorMode (uMode=0x1) returned 0x0 [0167.895] GetProcessHeap () returned 0x460000 [0167.896] RegDisablePredefinedCacheEx () returned 0x0 [0167.896] EtwEventRegister () returned 0x5 [0167.896] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe\" " [0167.896] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\svchost.exe\" ") returned 58 [0167.896] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb2) returned 0x470610 [0167.896] LCMapStringW (in: Locale=0x400, dwMapFlags=0x100, lpSrcStr="\"C:\\Users\\5p5NrGJn0jS", cchSrc=22, lpDestStr=0x47064c, cchDest=22 | out: lpDestStr="\"c:\\users\\5p5nrgjn0js") returned 22 [0167.896] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x470610 | out: hHeap=0x460000) returned 1 [0167.896] ExitProcess (uExitCode=0x0) Process: id = "26" image_name = "runonce.exe" filename = "c:\\windows\\syswow64\\runonce.exe" page_root = "0x76f3a000" os_pid = "0x21c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x798" cmd_line = "C:\\Windows\\SysWOW64\\runonce.exe /Run6432" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 328 os_tid = 0x42c Thread: id = 335 os_tid = 0x528 Thread: id = 340 os_tid = 0x134 Thread: id = 342 os_tid = 0x464 Thread: id = 344 os_tid = 0x524 Process: id = "27" image_name = "svchost.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe" page_root = "0x75152000" os_pid = "0x41c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x798" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 329 os_tid = 0x430 [0167.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1dfdb0 | out: lpSystemTimeAsFileTime=0x1dfdb0*(dwLowDateTime=0xd3c5b6a0, dwHighDateTime=0x1d581c5)) [0167.817] GetCurrentProcessId () returned 0x41c [0167.817] GetCurrentThreadId () returned 0x430 [0167.817] GetTickCount () returned 0x1136845 [0167.817] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfda8 | out: lpPerformanceCount=0x1dfda8*=9754956558) returned 1 [0167.819] GetModuleHandleA (lpModuleName=0x0) returned 0x630000 [0167.819] __set_app_type (_Type=0x2) [0167.819] __p__fmode () returned 0x755331f4 [0167.819] __p__commode () returned 0x755331fc [0167.826] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x633791) returned 0x0 [0167.826] __wgetmainargs (in: _Argc=0x6350b8, _Argv=0x6350c0, _Env=0x6350bc, _DoWildCard=0, _StartInfo=0x635050 | out: _Argc=0x6350b8, _Argv=0x6350c0, _Env=0x6350bc) returned 0 [0167.826] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x633a75) returned 0x633791 [0167.827] SetErrorMode (uMode=0x1) returned 0x0 [0167.827] GetProcessHeap () returned 0x7e0000 [0167.828] RegDisablePredefinedCacheEx () returned 0x0 [0167.828] EtwEventRegister () returned 0x5 [0167.828] GetCommandLineW () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" " [0167.828] lstrlenW (lpString="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" ") returned 75 [0167.828] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xd4) returned 0x7f06a8 [0167.828] LCMapStringW (in: Locale=0x400, dwMapFlags=0x100, lpSrcStr="\"C:\\ProgramData\\Microsoft\\Windows\\Start", cchSrc=40, lpDestStr=0x7f06e4, cchDest=40 | out: lpDestStr="\"c:\\programdata\\microsoft\\windows\\start") returned 40 [0167.828] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f06a8 | out: hHeap=0x7e0000) returned 1 [0167.828] ExitProcess (uExitCode=0x0) Process: id = "28" image_name = "svchost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe" page_root = "0x75866000" os_pid = "0x478" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x798" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 330 os_tid = 0x458 [0167.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xef8f4 | out: lpSystemTimeAsFileTime=0xef8f4*(dwLowDateTime=0xd3ccdac0, dwHighDateTime=0x1d581c5)) [0167.857] GetCurrentProcessId () returned 0x478 [0167.857] GetCurrentThreadId () returned 0x458 [0167.857] GetTickCount () returned 0x1136874 [0167.857] QueryPerformanceCounter (in: lpPerformanceCount=0xef8ec | out: lpPerformanceCount=0xef8ec*=9758907413) returned 1 [0167.859] GetModuleHandleA (lpModuleName=0x0) returned 0x650000 [0167.859] __set_app_type (_Type=0x2) [0167.859] __p__fmode () returned 0x755331f4 [0167.859] __p__commode () returned 0x755331fc [0167.859] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x653791) returned 0x0 [0167.859] __wgetmainargs (in: _Argc=0x6550b8, _Argv=0x6550c0, _Env=0x6550bc, _DoWildCard=0, _StartInfo=0x655050 | out: _Argc=0x6550b8, _Argv=0x6550c0, _Env=0x6550bc) returned 0 [0167.860] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x653a75) returned 0x653791 [0167.860] SetErrorMode (uMode=0x1) returned 0x0 [0167.860] GetProcessHeap () returned 0x4d0000 [0167.860] RegDisablePredefinedCacheEx () returned 0x0 [0167.860] EtwEventRegister () returned 0x5 [0167.860] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" " [0167.860] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" ") returned 106 [0167.860] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x112) returned 0x4e07c0 [0167.860] LCMapStringW (in: Locale=0x400, dwMapFlags=0x100, lpSrcStr="\"C:\\Users\\5p5NrGJn0jS", cchSrc=22, lpDestStr=0x4e07fc, cchDest=22 | out: lpDestStr="\"c:\\users\\5p5nrgjn0js") returned 22 [0167.860] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e07c0 | out: hHeap=0x4d0000) returned 1 [0167.860] ExitProcess (uExitCode=0x0) Process: id = "29" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x7d1c000" os_pid = "0x544" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 347 os_tid = 0x558 Thread: id = 352 os_tid = 0x5b8 Thread: id = 353 os_tid = 0x5b4 Thread: id = 354 os_tid = 0x5c8 Thread: id = 355 os_tid = 0x5d4 Thread: id = 356 os_tid = 0x548 Thread: id = 360 os_tid = 0x274 Process: id = "30" image_name = "reader_sl.exe" filename = "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe" page_root = "0x703f1000" os_pid = "0x6a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0x21c" cmd_line = "\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 363 os_tid = 0x6f8 Thread: id = 369 os_tid = 0x704 Thread: id = 381 os_tid = 0x6ec Thread: id = 389 os_tid = 0x7c0 Thread: id = 390 os_tid = 0x7c4 Process: id = "31" image_name = "adobearm.exe" filename = "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\adobearm.exe" page_root = "0x70915000" os_pid = "0x6b8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0x21c" cmd_line = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e3aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 364 os_tid = 0x698 Thread: id = 373 os_tid = 0x728 Thread: id = 374 os_tid = 0x6b4